Live › vulnerability › CVE-2026-115997
Go to dashboardpig-mesh pig up to 4.1.0 has an SQL injection flaw in the sort-argument resolver (SqlFilterArgumentResolver, orderItem.getColumn), where manipulated ascs/descs parameters are not sanitised. A remote attacker can alter database queries, which can expose or modify stored data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 00:21 UTC. All times on this page are UTC.
Applications built on pig-mesh pig up to 4.1.0 that use the pig-common-data sort resolver and accept ascs/descs parameters from requests are exposed. Systems not using pig, or running 4.1.1 or later, can skip it.
No product ranges from the sources yet.
4.1.0 are affected.pig-common-data and the SqlFilterArgumentResolver class in the dependency tree.4.1.1, which carries patch 9b6311161e346d7626c81d993044072fed2dca07.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.1.1 will fix this issue. This patch is called 9b6311161e346d7626c81d993044072fed2dca07. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-115997")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.