Description
A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen\src\main\java\com\pig4cloud\pig\codegen\service\impl\GeneratorServiceImpl.java of the component pig-codegen. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-07-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The pig-mesh Pig application contains a flaw in the pig-codegen component, specifically in GeneratorServiceImpl.java, that allows an attacker to inject arbitrary code. The vulnerability arises from unsanitized input handling, leading to code injection that can alter application behavior and potentially execute unauthorized commands.

Affected Systems

Systems running pig-mesh Pig version 3.9.2 or earlier that include the pig-codegen module are susceptible. The vulnerability is present in the pig-codegen component’s GeneratorServiceImpl endpoint, which must be reachable for exploitation.

Risk and Exploitability

The CVSS score of 5.3 places the issue in the moderate range. The EPSS score is below 1%, indicating a low probability of exploitation in the wild, but public exploit code is available. The vulnerability can be triggered remotely, and while the description does not specify the exact impact of injected code, the potential to execute arbitrary code elevates concern. The vulnerability is not listed in CISA’s KEV catalog. Organizations should treat it with moderate urgency and consider the potential for broader compromise if exploited.

Generated by OpenCVE AI on July 31, 2026 at 12:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the pig-mesh Pig installation to a release newer than 3.9.2 that contains the fix for the code‑injection flaw.
  • If an upgrade cannot be applied immediately, block inbound traffic to the GeneratorServiceImpl endpoint or restrict it to known, trusted sources using firewall or network segmentation.
  • Add application‑level input validation and sanitization for payloads processed by GeneratorServiceImpl, and deploy a web application firewall rule set to detect and block injection patterns.

Generated by OpenCVE AI on July 31, 2026 at 12:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 12 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen\src\main\java\com\pig4cloud\pig\codegen\service\impl\GeneratorServiceImpl.java of the component pig-codegen. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection
First Time appeared Pig-mesh
Pig-mesh pig
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:pig-mesh:pig:*:*:*:*:*:*:*:*
Vendors & Products Pig-mesh
Pig-mesh pig
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Pig-mesh Pig
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-13T18:12:15.612Z

Reserved: 2026-07-12T06:22:45.472Z

Link: CVE-2026-15512

cve-icon Vulnrichment

Updated: 2026-07-13T18:05:29.479Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T12:30:16Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')