PT-2026-78421 · Unknown · Stigmem-Node
CVE-2026-76240
·
Published
2026-05-29
·
Updated
2026-08-20
CVSS v4.0
7.5
High
| Vector | AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
stigmem-node version 0.9.0a1
Description
The software interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. While the schema value in the affected code path is operator-controlled, this pattern could allow SQL injection if a schema name is derived from tenant, request, or user input.
Recommendations
Update to version 0.9.0a2.
As a temporary workaround, only configure schema names from trusted deployment configuration.
Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Stigmem-Node