CVE-2026-76241

The record

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned (potentially malicious) plugin code could be loaded and executed, resulting in arbitrary code execution. Fixed in 0.9.0a2, which requires a second explicit acknowledgment to disable signature enforcement.

Affected packages

Related vulnerabilities

• CVE-2026-102930 virtualenv is a tool for creating isolated virtual python environments. CWE-494
• CVE-2026-79963 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-494
• CVE-2026-62654 A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). CWE-494
• CVE-2026-84664 Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection… CWE-494
• CVE-2026-84666 Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows… CWE-494
• CVE-2026-80047 A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote… CWE-494
• CVE-2026-82021 Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled… CWE-494
• CVE-2026-59286 The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a… CWE-494