{"action":"Upgrade Marten to 9.13.0 or later.","affected":[{"fixed":"9.13.0","introduced":"7.0.0"}],"component":"Marten","cve_ids":["CVE-2026-75513"],"ecosystem":"NuGet","epss":0.00468,"exploited":false,"fixed_versions":["9.13.0"],"ghsa_id":"GHSA-rfx3-98h7-v3xp","id":"tcs_01M5N900FZEVJDHZA77PC8H59Q","modified_at":"2026-09-17T15:00:07.273360513Z","published_at":"2026-09-17T14:51:41Z","references":["https://osv.dev/vulnerability/GHSA-rfx3-98h7-v3xp","https://github.com/JasperFx/marten/security/advisories/GHSA-rfx3-98h7-v3xp","https://nvd.nist.gov/vuln/detail/CVE-2026-75513","https://github.com/JasperFx/marten/pull/4911","https://github.com/JasperFx/marten/commit/61882d0424854cb48703f08bdb246894ac576bed","https://github.com/JasperFx/marten","https://github.com/JasperFx/marten/releases/tag/9.13.0"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-rfx3-98h7-v3xp","url":"https://osv.dev/vulnerability/GHSA-rfx3-98h7-v3xp"}],"summary":"Marten's LINQ provider has SQL injection via unescaped string literals"}