Changes.Watch~ upgrade verdicts ~
Free digest
Securitysshole: password bypass in Alpine’s OpenSSH

critical vulnerability

Marten's LINQ provider has SQL injection via unescaped string literals

Fix availableCritical · CVSS 9.1EPSS 0.47%

Published Sep 17, 2026 · updated Nov 9, 2026

What to do

  1. Upgrade to a fixed version: Marten 8.37.4, Marten 9.13.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

NuGetMarten

Vulnerable versions
>= 7.0.0, < 8.37.4
Fixed in
8.37.4

Check your project: dotnet list package --include-transitive | grep -i Marten

NuGetMarten

Vulnerable versions
>= 9.0.0, < 9.13.0
Fixed in
9.13.0

Check your project: dotnet list package --include-transitive | grep -i Marten

Sources

CWE-89 Improper Neutralization of Special Elements used in an SQL Command

← All critical vulnerabilities