CyberRota Analysis
AI-Generatedstigmem-node version 0.9.0a1 is vulnerable due to a configuration flaw that allows the disabling of plugin signature enforcement without requiring a second explicit acknowledgment. This oversight can lead to the execution of unsigned and potentially malicious plugins, resulting in arbitrary code execution if deployed in environments where plugin directories are writable by less-trusted users. Organizations using stigmem-node should prioritize upgrading to version 0.9.0a2 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned (potentially malicious) plugin code could be loaded and executed, resulting in arbitrary code execution. Fixed in 0.9.0a2, which requires a second explicit acknowledgment to disable signature enforcement.