# Marten's LINQ provider has SQL injection via unescaped string literals

Marten's LINQ provider interpolated dictionary indexer keys into SQL string literals unescaped, letting a quote break out and bypass tenant filters or exfiltrate data.

- Payout: Research
- Severity: critical
- Program: Marten
- Found by: svenclaesson
- Disclosed: 2026-09-17
- CVE: CVE-2026-75513
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-rfx3-98h7-v3xp
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-rfx3-98h7-v3xp
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:research platform:ghsa sev:critical tech:dotnet technique:chained technique:source-review vuln:sqli

**Target:** Marten .NET LINQ-to-SQL provider (PostgreSQL/Npgsql)
**Root cause:** Runtime values (dictionary indexer keys, ContainsKey args, Select constants, tenant ids) were interpolated into generated SQL as single-quoted literals without escaping or parameterization, so an embedded `'` breaks out of the literal.
**Steps:**
1. Use the EAV filter pattern `Where(x => x.Attributes[key] == v)` with attacker-controlled `key`.
2. Benign key `nonexistent-key` returns 0 rows.
3. Send key `nonexistent' = '' or 1=1 --` which returns all rows.
4. Generated SQL: `select d.data from public.mt_doc_doc as d where d.data -> 'Attributes' ->> 'x' or 1=1 --' = :p0;`
5. With `;`-batching enabled (Npgsql default), append batched statements for data modification.
**How found:** Researcher audited Marten's LINQ member handling and noticed dictionary indexer keys were rendered as quoted literals rather than parameters; confirmed with a benign-vs-injection key comparison, then a LINQ-wide audit found additional sinks.
**Exploitation:** Attacker supplies a crafted dictionary key (or ContainsKey arg / Select constant / tenant id) reaching the LINQ provider; the injected predicate makes the WHERE clause always true, returning other tenants' rows (authorization bypass) and enabling blind exfiltration; batched statements allow writes.
**Escalation:** Multi-tenant filter bypass to cross-tenant data access; `;`-batching extends to data modification.
**Insight:** EAV/'filter by attribute name' patterns where the key is user-supplied are a prime injection surface in ORMs that render member access as SQL literals; test benign-vs-quote keys to detect literal interpolation, and check ContainsKey/Select-constant/tenant-id paths too.