CVE-2026-76241 — stigmem Plugin Signature Enforcement Bypass via Configuration
stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into…
Published: 2026-08-19 · CVSS: 7.3 · CVSS 4.0
stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned (potentially malicious) plugin code could be loaded and executed, resulting in arbitrary code execution. Fixed in 0.9.0a2, which requires a second explicit acknowledgment to disable signature enforcement.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7