CVE-2026-76241
Received Received - Intake

Plugin Signature Bypass in stigmem-node

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned (potentially malicious) plugin code could be loaded and executed, resulting in arbitrary code execution. Fixed in 0.9.0a2, which requires a second explicit acknowledgment to disable signature enforcement.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76241
EUVD
EUVD-2026-62405

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
stigmem stigmem-node to 0.9.0a2 (exc)
eidetic_labs stigmem_node to 0.9.0a2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-494 The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

stigmem-node 0.9.0a1 has a flaw where plugin signature enforcement can be disabled with just one configuration flag without requiring a second confirmation. This means if the setting is used in an environment where less trusted users can write to plugin directories, malicious unsigned plugins could be loaded and executed, leading to arbitrary code execution.

Detection Guidance

Check stigmem-node configuration files for the setting that disables plugin signature enforcement without a second acknowledgment. Look for any instances of the vulnerable version 0.9.0a1.

Impact Analysis

If exploited, this vulnerability allows attackers with access to writable plugin directories to execute arbitrary code on the affected system. This could lead to data breaches, system compromise, or further network infiltration depending on the system's role and permissions.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations if this flaw results in unauthorized access to personal or health data.

Mitigation Strategies

Upgrade stigmem-node to version 0.9.0a2 or later, which enforces a second explicit acknowledgment for disabling signature enforcement. Ensure plugin directories are not writable by less-trusted users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76241. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart