CVE-2026-75513: Marten's LINQ provider has SQL injection via unescaped string literals

Several code paths in Marten’s LINQ provider and tenant-management internals interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted string literal without escaping or parameterization. A value containing a single quote (') could break out of the literal and inject arbitrary SQL.

The primary vector is a Dictionary<,> indexer key used in a Where filter — Where(x => x.Attributes[key] == v) — a common “filter by attribute name” / EAV pattern. It is confirmed with an executed proof-of-concept and yields filter / multi-tenant authorization bypass (returning other tenants’ rows) and blind data exfiltration. Where the application permits ;-batched statements (Npgsql default), data modification is also possible.