Executive brief
Stigmem-node is a component of the Stigmem framework used for managing data nodes. A vulnerability in how it handles PostgreSQL database schema names could allow an attacker with administrative configuration access to execute unauthorized database commands. This could lead to full access, modification, or deletion of data stored in the database.
Technical details
A SQL injection vulnerability (CWE-89) exists in stigmem-node's PostgreSQL backend where schema identifiers are interpolated directly into SQL strings without proper quoting or validation. While currently limited to operator-controlled configuration paths, the lack of defensive quoting creates a risk of exploitation if schema names are ever derived from untrusted sources like tenant IDs or request headers. An attacker with the ability to influence these identifiers could execute arbitrary SQL commands with the privileges of the database user. The issue is resolved in version 0.9.0a2 by implementing defensive identifier quoting and enhanced validation.
Affected products
- Eidetic Labs stigmem-node < 0.9.0a2
Timeline
- 2026-05-18: patched: Version 0.9.0a2 released
- 2026-05-29: disclosed: GitHub Advisory published
References
- https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-9pc9-4crj-mhpj
- https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/CHANGELOG.md
- https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/SECURITY.md
- https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a2
- https://api.github.com/repos/eidetic-labs/stigmem/security-advisories/GHSA-9pc9-4crj-mhpj