CVE-2026-76240
HighCVSS 7.5Summary
stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input. Fixed in 0.9.0a2.
Risk Assessment
SQL injection could allow an attacker to gain unauthorized access to the database, modify or delete data, posing a serious threat to confidentiality and integrity.
Recommendation
Upgrade stigmem-node to version 0.9.0a2, which adds identifier quoting and validation, and configure schema names only from trusted deployment configuration.
Original NVD description (English source)
stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input. Fixed in 0.9.0a2, which adds identifier quoting and validation. As a workaround, only configure schema names from trusted deployment configuration.