CVE-2026-76241 describes a vulnerability in stigmem-node 0.9.0 where plugin signature enforcement can be disabled with a single configuration flag. If this insecure configuration is used in an environment where plugin directories are writable by less-trusted users, attackers could place unsigned plugins that would be loaded and executed, resulting in arbitrary code execution. The vulnerability is resolved in version 0.9.0a2 by requiring a second explicit acknowledgment to disable signature enforcement, preventing accidental or unauthorized disabling of this security feature.

An attacker with write access to plugin directories could introduce unsigned malicious plugins that the application would load and execute, leading to arbitrary code execution. This compromises the integrity and security of the affected system. The CVSS 4.0 score is 7.3 (high severity), reflecting the potential for privilege escalation and code execution with low attack complexity but requiring some privileges.

Upgrade to stigmem-node version 0.9.0a2 or later, which enforces a second explicit acknowledgment before disabling plugin signature enforcement. This prevents accidental or unauthorized disabling of signature checks. Until upgraded, ensure that plugin directories are not writable by less-trusted users to reduce the risk of malicious plugin insertion. Patch status is not explicitly confirmed in the vendor advisory, but the fix is stated to be in 0.9.0a2.