CVE-2026-76241: falha de alta gravidade em eidetic-labs stigmem
stigmem Plugin Signature Enforcement Bypass via Configuration
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.3epss 0.1%
stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned (potentially malicious) plugin code could be loaded and executed, resulting in arbitrary code execution. Fixed in 0.9.0a2, which requires a second explicit acknowledgment to disable signature enforcement.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
eidetic-labs · stigmemCVEs relacionadas — eidetic-labs stigmem
No mesmo produto, das mais perigosas para as menos.
CVE-2026-76243CRITICALstigmem before 0.9.0a2 Authentication Bypass via Disabled AuthEPSS 0.6%CVE-2026-76240HIGHstigmem Postgres SQL Injection via Schema IdentifierEPSS 0.4%CVE-2026-76242CRITICALstigmem Federation Peer Registration Authentication BypassEPSS 0.3%CVE-2026-76244CRITICALstigmem-node Insecure Federation Transport ConfigurationEPSS 0.3%CVE-2026-76245HIGHstigmem Federation Peer Token Timestamp Validation BypassEPSS 0.2%