SQL Injection Affecting stigmem-node package, versions [,0.9.0a2)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-STIGMEMNODE-17661121
- published28 Jun 2026
- disclosed29 May 2026
- creditUnknown
Introduced: 29 May 2026
CVE NOT AVAILABLE CWE-89 (opens in a new tab)How to fix?
Upgrade stigmem-node to version 0.9.0a2 or higher.
Overview
stigmem-node is a Stigmem reference node — single-host production implementation
Affected versions of this package are vulnerable to SQL Injection in the handling of Postgres schema identifiers due to improper quoting and interpolation into SQL strings. An attacker can execute arbitrary SQL commands by supplying crafted schema names. This is only exploitable if schema names are derived from untrusted sources such as request, tenant, header, or user input.
Workaround
This vulnerability can be mitigated by configuring schema names only from trusted deployment configuration and avoiding the use of untrusted input for schema names.