CVE-2026-76240 — stigmem Postgres SQL Injection via Schema Identifier
stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controll…
Published: 2026-08-19 · CVSS: 7.5 · CVSS 4.0
stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input. Fixed in 0.9.0a2, which adds identifier quoting and validation. As a workaround, only configure schema names from trusted deployment configuration.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7