CVE-2026-76240

High

Description

stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input. Fixed in 0.9.0a2, which adds identifier quoting and validation. As a workaround, only configure schema names from trusted deployment configuration.

SeverityHigh

CVSS7.5

Exploit probability—

ProductStigmem-node

PublishedAug 19, 2026

First seenAug 19, 2026

Weakness typeCWE-89SQL injection

How to fix

Update

stigmem-node0.9.0a2 or later

Vendor advisories

github.com/eidetic-labs/stigmem/security/advisories/GHSA-9pc9-4crj-mhpj

Affected products

Product	Affected versions	Fixed in
stigmem-nodePyPI	v < 0.9.0a2	0.9.0a2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.