Marten's LINQ provider suffers from SQL injection vulnerabilities due to unescaped string literals in several code paths, primarily involving dictionary indexer keys used in filters. This flaw allows attackers to inject arbitrary SQL by including single quotes in input values, leading to multi-tenant authorization bypass, blind data exfiltration, and potentially data modification if multi-statement batching is enabled. The issue affects versions from 7.0.0 up to but not including 8.37.4 and from 9.0.0 up to but not including 9.13.0. A fix is available in versions 8.37.4 and 9.13.0, which properly escape or parameterize inputs to prevent injection. Until patched, users should avoid passing untrusted input in vulnerable contexts and disable multi-statement command batching to reduce risk.