CVE-2026-76241
Description
stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned (potentially malicious) plugin code could be loaded and executed, resulting in arbitrary code execution. Fixed in 0.9.0a2, which requires a second explicit acknowledgment to disable signature enforcement.
Is your site exposed to CVE-2026-76241?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2026-76241? +
How do I check if I'm vulnerable to CVE-2026-76241? +
Related Vulnerabilities
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels …
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead …
The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient …
Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs …
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths …
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup …
