Medium severity · published Jul 12, 2026
CVE-2026-15512
pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen\src\main\java\com\pig4cloud\pig\codegen\service\impl\GeneratorServiceImpl.java of the component pig-codegen. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
Pig · pig-mesh
3.9.0; 3.9.1; 3.9.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15512
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-15512
github.com
https://github.com/sombra0316/CVE-2026/blob/main/pig-mesh/SSIT.md
vuldb.com
https://vuldb.com/cve/CVE-2026-15512
vuldb.com
https://vuldb.com/submit/847500
vuldb.com
https://vuldb.com/vuln/377841
vuldb.com
https://vuldb.com/vuln/377841/cti
More from Pig
9.1
CVE-2026-91995
pig before 4.1.0 Unverified Password Change via /register/password
6.3
CVE-2026-115997
pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection
4.3
CVE-2026-111343
pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}