CVE-2026-76241: Download of Code Without Integrity Check in eidetic-labs stigmem

CVE-2026-76241 affects stigmem-node 0.9.0a1 and earlier versions, allowing an attacker to disable plugin signature enforcement via a single configuration flag without a second explicit confirmation. If the environment permits less-trusted users to write to plugin directories, unsigned and potentially malicious plugins can be loaded and executed, resulting in arbitrary code execution. The vulnerability is addressed in version 0.9.0a2, which introduces a requirement for a second explicit acknowledgment to disable signature enforcement.

An attacker with the ability to write to plugin directories in affected stigmem-node environments can load and execute arbitrary unsigned plugin code, leading to arbitrary code execution with the privileges of the stigmem-node process. This can compromise the affected system's integrity and security.

Upgrade stigmem-node to version 0.9.0a2 or later, which requires a second explicit acknowledgment to disable plugin signature enforcement, preventing accidental or unauthorized disabling of this security feature. Until upgraded, ensure that plugin directories are not writable by less-trusted users to mitigate the risk of loading unsigned plugins.