Medium severity · published Oct 24, 2026
CVE-2026-115997
pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection
New
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.1.1 will fix this issue. This patch is called 9b6311161e346d7626c81d993044072fed2dca07. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
pig · pig-mesh
4.0; 4.1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115997
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115997
github.com
https://github.com/pig-mesh/pig/
github.com
https://github.com/pig-mesh/pig/commit/9b6311161e346d7626c81d993044072fed2dca07
github.com
https://github.com/pig-mesh/pig/pull/1289
github.com
https://github.com/pig-mesh/pig/releases/tag/v4.1.1
github.com
https://github.com/vinch3s/pig4cloud-cve/blob/main/Pig4Cloud-SQL-Injection.md
vuldb.com
https://vuldb.com/cve/CVE-2026-115997
More from pig
9.1
CVE-2026-91995
pig before 4.1.0 Unverified Password Change via /register/password
6.3
CVE-2026-15512
pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection
4.3
CVE-2026-111343
pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}