CVE-2026-115997 in pig
Summary
by MITRE • 10/25/2026
A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.1.1 will fix this issue. This patch is called 9b6311161e346d7626c81d993044072fed2dca07. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in pig-mesh versions up to 4.1.0 represents a critical security flaw within the application's data handling layer, specifically located in the SqlFilterArgumentResolver class found in the pig-common-data module. This component is responsible for resolving SQL filter arguments during request processing, acting as an intermediary between user-supplied input and database query construction. The specific function orderItem.getColumn is where the logic fails to adequately sanitize or validate inputs related to sorting parameters. When a remote attacker manipulates the argument values associated with asc or desc ordering directives, they can inject malicious SQL code into the underlying database queries. This type of vulnerability falls squarely under CWE-89, which defines Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The flaw arises because the application likely concatenates user-controlled input directly into a query string without sufficient escaping or parameterization, allowing an attacker to alter the intended logic of the database operation.
The operational impact of this vulnerability is severe due to its remote exploitability and the nature of SQL injection attacks. An authenticated or unauthenticated attacker, depending on the specific access controls surrounding the affected endpoint, can execute arbitrary SQL commands against the backend database. This capability extends beyond simple data retrieval; it allows for unauthorized modification, deletion, or extraction of sensitive information stored within the application's persistent storage. In many modern web applications using frameworks like Spring Boot and MyBatis, which pig-mesh utilizes, such flaws can lead to full system compromise if the database user has elevated privileges. The attacker could potentially dump entire tables containing personally identifiable information, financial records, or administrative credentials. Furthermore, depending on the database engine configuration, SQL injection may allow for operating system command execution through specific functions like xp_cmdshell in Microsoft SQL Server or LOAD_FILE in MySQL, thereby escalating the breach from data theft to complete server control.
The existence of a published exploit significantly increases the risk profile associated with this vulnerability. Attackers frequently leverage automated tools and public proof-of-concept code to scan for known vulnerable instances across the internet. Since pig-mesh is an open-source enterprise-level microservice framework, many organizations deploy it without applying subsequent patches promptly due to integration complexities or lack of awareness regarding minor version updates. The fact that the vendor was contacted early suggests a responsible disclosure process was followed, yet the window between initial discovery and public patch availability remains a period of high exposure for systems running affected versions. Organizations relying on this framework must recognize that even if no active attacks are observed in their logs, the presence of known exploit code makes them prime targets for opportunistic scanning campaigns conducted by threat actors seeking low-hanging fruit to establish an initial foothold within corporate networks.
To mitigate this risk, immediate action is required to upgrade pig-mesh and its associated dependencies to version 4.1.1 or later. The vendor has released a specific patch identified by commit hash 9b6311161e346d7626c81d993044072fed2dca07, which addresses the input validation logic within the SqlFilterArgumentResolver class. This update likely implements proper parameterization or strict allow-listing for sorting columns and directions to prevent arbitrary SQL construction. In addition to upgrading, organizations should review their database access policies to ensure that application-level accounts operate with the principle of least privilege, limiting permissions to only those necessary for normal operation. Implementing a Web Application Firewall can provide an additional layer of defense by detecting and blocking common SQL injection patterns in HTTP requests, although this is not a substitute for fixing the root cause in the codebase. Security teams should also conduct thorough testing after deployment to ensure that the upgrade does not introduce regressions while confirming that the vulnerability vector has been effectively closed. Continuous monitoring of application logs for anomalous database query patterns can help detect any potential exploitation attempts during the transition period or if similar vulnerabilities are discovered elsewhere in the stack.