CVE-2026-76241 stigmem Plugin Signature Enforcement Bypass via Configuration
Attackers can bypass plugin signature enforcement via configuration to execute arbitrary code if plugin directories are writable.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76241?
CVE-2026-76241 is a high-severity vulnerability in eidetic-labs stigmem, published on 19 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned (potentially malicious) plugin code could be loaded and executed, resulting in arbitrary code execution. Fixed in 0.9.0a2, which requires a second explicit acknowledgment to disable signature enforcement.
Weakness: CWE-494
Which versions are affected by CVE-2026-76241?
2 open source packages ship an affected version, including stigmem-node.
| Package | Affected | Fixed in |
|---|---|---|
stigmem-node PyPI | All versions | 0.9.0a2 |
stigmem-node PyPI | All versions | 0.9.0a2 |
How do I fix CVE-2026-76241?
Upgrade stigmem-node to 0.9.0a2 or later.
Is CVE-2026-76241 being exploited?
There is no known exploitation of CVE-2026-76241 in the wild and no public exploit code.
Sources
Also known as GHSA-q84h-wr78-498w, GHSA-w7pm-9g55-mxfm.