SQL Injection Risk in Stigmem Node by Eidetic Labs
CVE-2026-76240

7.5HIGH

Key Information:

Vendor

Eidetic-labs

Status
Stigmem
Vendor
CVE Published:
19 August 2026

What is CVE-2026-76240?

The Stigmem Node version 0.9.0a1 contains a vulnerability that allows for SQL injection due to the interpolation of Postgres backend schema identifiers into SQL strings without appropriate defensive quoting. This vulnerability surfaces in situations where the schema name can be manipulated by user inputs, potentially leading to unauthorized database access or data manipulation. The issue has been addressed in version 0.9.0a2 through the implementation of identifier validation and quoting mechanisms. To mitigate risks, it's recommended to configure schema names only from trusted sources.

Affected Version(s)

stigmem 0 < 0.9.0a2

stigmem 0.9.0a2

References

https://github.com/eidetic-labs/stigmem/security/advisori...
vendor-advisory
https://www.vulncheck.com/advisories/stigmem-postgres-sql...
third-party-advisory

CVSS V4

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.