Detections
Analytics

SCA: security update for Marten (GHSA-rfx3-98h7-v3xp)

critical Tenable Cloud Security Plugin ID 478835

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0,
 several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled
 strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector
 is a dictionary indexer key used by Where filters in
 src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include
 SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs reached through
 IEventStore.DeleteProjectionProgressAsync, while DictionaryContainsKeyFilter.cs (Newtonsoft serializer
 only; System.Text.Json is not affected) handles ContainsKey calls. Events/Daemon/Internals/EventLoader.cs
 contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth
 sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant
 authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql
 statements may also allow data modification. This issue is fixed in version 9.13.0. (CVE-2026-75513)

Solution

Update the Marten library and its related packages to version 8.37.4 or later.

See Also

https://github.com/advisories/GHSA-rfx3-98h7-v3xp

Plugin Details

Severity: Critical

ID: 478835

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 11/9/2026

Updated: 11/9/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

Percentile: 57.52

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 8

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:P/A:P

CVSS Score Source: CVE-2026-75513

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/17/2026

Vulnerability Publication Date: 9/16/2026

Reference Information

CVE: CVE-2026-75513

cwe: CWE-89