What’s Vulnerable › Vulnerabilities

CVE-2026-76241: stigmem Plugin Signature Enforcement Bypass via Configuration

• Severity: high (CVSS 7.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-19 · updated 2026-09-11
• Weakness: CWE-494

Description

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned (potentially malicious) plugin code could be loaded and executed, resulting in arbitrary code execution. Fixed in 0.9.0a2, which requires a second explicit acknowledgment to disable signature enforcement.

Affected products

• eidetic-labs stigmem: before 0.9.0a2 — fixed in 0.9.0a2

How to fix

Upgrade to a fixed version: eidetic-labs stigmem 0.9.0a2. Check the vendor advisory for mitigations.

References

• https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-w7pm-9g55-mxfm
• https://www.vulncheck.com/advisories/stigmem-plugin-signature-enforcement-bypass-via-configuration

Get alerted when CVE-2026-76241 or the next vulnerability affects your stack