CVE-2026-76240 stigmem Postgres SQL Injection via Schema Identifier
Attackers can execute arbitrary SQL commands via unquoted schema identifiers in stigmem-node, potentially compromising database integrity and confidentiality.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76240?
CVE-2026-76240 is a high-severity SQL injection vulnerability in eidetic-labs stigmem, published on 19 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input. Fixed in 0.9.0a2, which adds identifier quoting and validation. As a workaround, only configure schema names from trusted deployment configuration.
Weakness: CWE-89
Which versions are affected by CVE-2026-76240?
2 open source packages ship an affected version, including stigmem-node.
| Package | Affected | Fixed in |
|---|---|---|
stigmem-node PyPI | All versions | 0.9.0a2 |
stigmem-node PyPI | All versions | 0.9.0a2 |
How do I fix CVE-2026-76240?
Upgrade stigmem-node to 0.9.0a2 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-76240 being exploited?
There is no known exploitation of CVE-2026-76240 in the wild and no public exploit code.
Sources
Also known as GHSA-9pc9-4crj-mhpj, GHSA-vgv8-r42h-hgr6.