CVE-2026-76240 describes an SQL injection vulnerability in stigmem-node 0.9.0a1 where Postgres backend schema identifiers are directly interpolated into SQL strings without defensive quoting. The schema value is operator-controlled, which could lead to SQL injection if schema names are derived from tenant, request, or user input. The vulnerability is fixed in version 0.9.0a2 by implementing identifier quoting and validation to prevent injection. Until upgrading, it is recommended to only use trusted schema names from deployment configuration.

An attacker with the ability to influence the schema identifier value could exploit this vulnerability to perform SQL injection attacks, potentially compromising the database integrity and confidentiality. The CVSS 4.0 score of 7.5 reflects a high severity with network attack vector, low attack complexity, and partial privileges required. No known exploits in the wild have been reported.

Upgrade stigmem-node to version 0.9.0a2 or later, which includes proper identifier quoting and validation to prevent SQL injection. As a temporary workaround, ensure schema names are configured only from trusted deployment configurations and not from user-controllable input.