CVE-2026-15512

MediumCVSS 6.3

Published: 13/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

33th percentile - higher than 33% of all known CVEs

Summary

A code injection vulnerability was found in pig-mesh Pig up to version 3.9.2 in the pig-codegen component. The issue affects an unknown functionality of the GeneratorServiceImpl.java file. The attack can be launched remotely and the exploit is publicly available.

Risk Assessment

The organization is at risk of remote code execution, which could lead to system compromise, data theft, or service disruption.

Recommendation

Immediately update pig-mesh Pig to a version newer than 3.9.2 if available, or apply temporary mitigations such as input filtering and restricting access to the pig-codegen component.

Other vulnerabilities in pig-mesh Pig

CVE-2026-115997Medium
A SQL injection vulnerability was found in pig-mesh pig up to version 4.1.0, affecting the orderItem.getColumn function in SqlFilterArgumentResolver.java. Manipulating the ascs/descs arguments allows SQL injection, and the attack can be launched remotely. The exploit has been published and may be used.

Original NVD description (English source)

A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen\src\main\java\com\pig4cloud\pig\codegen\service\impl\GeneratorServiceImpl.java of the component pig-codegen. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS