The stigmem-node package v0.9.0a1 contains a flaw where schema identifiers used in PostgreSQL queries are directly interpolated into SQL strings without proper quoting. This allows a malicious actor to inject arbitrary SQL when controlling the schema name through tenant, request, or user input. The consequence is unauthorized data access or manipulation and makes the database vulnerable to data exfiltration or modification.

This issue affects the stigmem-node application from eidetic‑labs, specifically version 0.9.0a1. The fix is available in version 0.9.0a2, which introduces identifier quoting and validation. Earlier releases are unpatched and vulnerable.

The vulnerability scores a CVSS of 7.5, rating it high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote user providing a crafted schema name through the application interface or configuration that influences the SQL statement. Successful exploitation would give the attacker the same privileges as the database user and could lead to data theft, modification, or possible remote code execution if additional injection paths exist.