Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Several code paths in Marten's LINQ provider and tenant-management internals interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted string literal without escaping or parameterization. A value containing a single quote (') could break out of the literal and inject arbitrary SQL. The primary vector is a Dictionary<, indexer key used in a Where filter — Where(x = x.Attributes[key] == v) — a common "filter by attribute name" / EAV pattern. It is confirmed with an executed proof-of-concept and yields filter / multi-tenant authorization bypass (returning other tenants' rows) and blind data exfiltration. Where the application permits ;-batched statements (Npgsql default), data modification is also possible. Affected sinks - Linq/Members/Dictionaries/DictionaryItemMember.cs — dictionary indexer key (primary, confirmed PoC) - Linq/Members/Dictionaries/DictionaryContainsKeyFilter.cs — Dictionary.ContainsKey(key) (Newtonsoft serializer only;…
Recommended action: Upgrade to 9.13.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Marten's full-text search APIs interpolated the user-supplied regConfig parameter directly into the generated SQL without parameterization or validation, making every code path that exposes regConfig to untrusted input a SQL injection sink. Affected APIs - IQuerySession.SearchAsync<T(string searchTerm, string regConfig, ...) - IQuerySession.PlainTextSearchAsync<T(...) - IQuerySession.PhraseSearchAsync<T(...) - IQuerySession.WebStyleSearchAsync<T(...) - IQuerySession.PrefixSearchAsync<T(...) - IQueryable<T.Where(x = x.Search(term, regConfig)) and the matching PlainTextSearch / PhraseSearch / WebStyleSearch / PrefixSearch extension methods Details In the affected versions, FullTextWhereFragment renders the WHERE-clause SQL by string interpolation: regConfig arrives unchanged from the public API surface above. Any value containing a single quote terminates the SQL literal and lets an attacker append arbitrary PostgreSQL. Confirmed exploit shapes (with regConfig set to…
Recommended action: Upgrade to 8.37.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.