stigmem-node EUVD-2026-62404

Exploitation requires operator-level privilege to control the PostgreSQL schema name configured for the stigmem-node Postgres backend (PR:H per CVSS 4.0 vector). In the specific code path present in 0.9.0a1, the schema value is set at deployment time by an operator, meaning unauthenticated external attackers cannot exploit this directly against default configurations. The AT:P (attack requirements present) metric reflects the additional conditional: the vulnerable pattern becomes remotely or tenant-exploitable only if schema names are derived from request parameters, HTTP headers, tenant identifiers, or user-supplied input - a non-default use pattern. Limiting factors include the requirement for operator or admin-level access to the deployment configuration, the absence of any network-accessible injection surface in standard operator-only schema configuration, and the constraint that the vulnerable code path in 0.9.0a1 does not itself accept external input for schema names.

The CVSS 4.0 score of 7.5 is appropriately calibrated given the PR:H and AT:P metrics: exploitation requires operator-level access to configure schema names, and specific conditions must be present beyond baseline deployment. In practice, the current codebase constrains the vulnerable call site to operator-controlled values, meaning an attacker must already hold elevated deployment access - even a mid-sized municipal IT team in rybnik deploying this library should treat the upgrade as routine maintenance rather than an emergency patch event. No CISA KEV listing and no public exploit code have been identified, and EPSS data was not provided in the input, so exploitation probability cannot be quantified. The principal real-world risk is latent: if a downstream integration or future code change allows schema names to flow from tenant, request, or user input, the unquoted pattern becomes a directly exploitable injection vector. High C/I/A impact metrics reflect what becomes possible if that condition materializes, not the baseline operator-controlled deployment scenario.

An operator with write access to the stigmem-node deployment configuration injects a crafted PostgreSQL identifier - for example, a schema name containing a closing double-quote followed by appended SQL statements - into the schema setting. When stigmem-node interpolates that value unquoted into a SQL string for the Postgres backend, the injected payload executes arbitrary SQL with the privileges of the database session, enabling data exfiltration or modification. No public proof-of-concept code has been identified at time of analysis.