← Back to the live CVE advisory feed

CVE-2026-115997: pig

Severity

2.1 (LOW)

Vendor

PIG-MESH

Affected versions

4.0; 4.1.0

Fixed version

4.1.1

Patch status

Patched

Published

2026-10-25T00:16:45.047

Modified

2026-10-25T00:16:46.110

Why it matters

Vulnerability requiring standard triage and vendor validation.

Recommended admin actions

• Review during normal vulnerability triage unless the affected system is internet-facing or business-critical.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.1.1 will fix this issue. This patch is called 9b6311161e346d7626c81d993044072fed2dca07. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.

View the official NVD record for CVE-2026-115997

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.