Marten LINQ Provider SQL Injection: Early Warning for Engineers
- Severity
- HIGH
- Affected component
- marten (nuget)
- Affected versions
- >= 7.0.0, <= 9.12.0
- Patched version
- Not yet available
Marten's LINQ provider is under investigation for a SQL injection vulnerability due to unescaped string literals. Engineers using affected versions should assess their exposure.
What happened
Marten's LINQ provider reportedly has a SQL injection vulnerability caused by unescaped string literals. This issue allows for SQL injection and multi-tenant authorization bypass. The vulnerability affects versions 7.0.0 to 9.12.0 of the Marten NuGet package. The problem arises from several code paths that interpolate runtime values into generated SQL without proper escaping.
The vulnerability was first flagged on September 17, 2026. It is currently classified as an early warning with high severity. There are no reports of this vulnerability being exploited in the wild or as part of a supply-chain attack.
What to do about it
- Upgrade to the latest version of Marten to mitigate the SQL injection vulnerability.
- Review the provided fix to ensure all affected sinks are properly escaped.
- Consult the primary sources for the most current information and updates on this vulnerability.
How 0Day would have caught this
marten is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Marten NuGet package versions 7.0.0 to 9.12.0.
What should I do right now?
Upgrade to the latest version of Marten and review the provided fix to ensure all affected sinks are properly escaped.
Is there a patched version available?
The primary sources should be consulted for the latest information on patched versions.