CVE-2026-76240: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in eidetic-labs stigmem

stigmem-node 0.9.0a1 and 0.9.0 interpolate Postgres backend schema identifiers directly into SQL strings without defensive quoting, allowing potential SQL injection if schema names are derived from tenant, request, or user input. The vulnerability is addressed in version 0.9.0a2 by implementing identifier quoting and validation to prevent injection. The unsafe pattern occurs in a code path where the schema value is operator-controlled, posing a risk if untrusted input influences the schema name.

An attacker with the ability to influence the schema name could exploit this vulnerability to perform SQL injection attacks, potentially leading to unauthorized data access or manipulation. The CVSS 4.0 score of 7.5 (high severity) reflects the network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability with partial privileges required.

Upgrade to stigmem-node version 0.9.0a2 or later, which includes proper identifier quoting and validation to prevent SQL injection. As a temporary workaround, ensure that schema names are only configured from trusted deployment configurations and not derived from user or tenant input.