CVE-2026-115997
pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection
CVSS v3.1 (listed by NVD)
6.3
MEDIUM
Scored by vuldb.com (not yet scored by NVD)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0 (listed by NVD)
2.1
LOW
Scored by vuldb.com (not yet scored by NVD)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS (listed by CVE.org)
5.3
MEDIUM
Scored by CNA (VulDB) · v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.1 vector
NetworkLoginNo interaction
PoC
Confidentiality LIntegrity LAvailability L
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Privileges required PR | L | Regular user |
| User interaction UI | N | None |
| Scope S | U | Unchanged |
| Confidentiality C | L | Low |
| Integrity I | L | Low |
| Availability A | L | Low |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Description
NVD
A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.1.1 will fix this issue. This patch is called 9b6311161e346d7626c81d993044072fed2dca07. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 4.0 | 2.1 LOW | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD / [email protected] (Primary) | 3.1 | 6.3 MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD / [email protected] (Secondary) | 2.0 | 6.5 MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| CNA / VulDB | 4.0 | 5.3 MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P |
| CNA / VulDB | 3.1 | 6.3 MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
| CNA / VulDB | 3.0 | 6.3 MEDIUM | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
| CNA / VulDB | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| pig-mesh | pig | affected: 4.0 affected: 4.1.0 unaffected: 4.1.1 |
Linux distribution status
References (9)
- https://github.com/pig-mesh/pig/ NVD, CNA product
- https://github.com/pig-mesh/pig/commit/9b6311161e346d7626c81d993044072fed2dca07 NVD, CNA patch
- https://github.com/pig-mesh/pig/pull/1289 NVD, CNA issue-trackingpatch
- https://github.com/pig-mesh/pig/releases/tag/v4.1.1 NVD, CNA patch
- https://github.com/vinch3s/pig4cloud-cve/blob/main/Pig4Cloud-SQL-Injection.md NVD, CNA exploit
- https://vuldb.com/cve/CVE-2026-115997 NVD, CNA third-party-advisory
- https://vuldb.com/submit/991961 NVD, CNA third-party-advisory
- https://vuldb.com/vuln/426095 NVD, CNA vdb-entrytechnical-description
- https://vuldb.com/vuln/426095/cti NVD, CNA signaturepermissions-required