CVE-2026-76240: falha de alta gravidade em eidetic-labs stigmem
stigmem Postgres SQL Injection via Schema Identifier
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.4%
stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input. Fixed in 0.9.0a2, which adds identifier quoting and validation. As a workaround, only configure schema names from trusted deployment configuration.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
eidetic-labs · stigmemCVEs relacionadas — eidetic-labs stigmem
No mesmo produto, das mais perigosas para as menos.
CVE-2026-76243CRITICALstigmem before 0.9.0a2 Authentication Bypass via Disabled AuthEPSS 0.6%CVE-2026-76242CRITICALstigmem Federation Peer Registration Authentication BypassEPSS 0.3%CVE-2026-76244CRITICALstigmem-node Insecure Federation Transport ConfigurationEPSS 0.3%CVE-2026-76245HIGHstigmem Federation Peer Token Timestamp Validation BypassEPSS 0.2%CVE-2026-76241HIGHstigmem Plugin Signature Enforcement Bypass via ConfigurationEPSS 0.1%