CVE-2026-115997: pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection
A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.1.1 will fix this issue. This patch is called 9b6311161e346d7626c81d993044072fed2dca07. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pig-mesh pigto a version that resolves this vulnerability.Fixed in 4.1.1Patch 9b6311161e346d7626c81d993044072fed2dca07
Event History
Frequently Asked Questions
Which deployments are affected?
pig-mesh Pig versions up to and including 4.1.0 are affected. Version 4.1.1 fixes the issue.
What access does an attacker need?
The attack can be launched remotely, but the supplied severity vector indicates low privileges are required. Exploitation involves manipulating the ascs or descs argument processed by the affected resolver.
Is exploit code available?
Yes. The vulnerability information states that an exploit has been published and may be used.
What should be done if the affected component is in use?
Upgrade pig-mesh Pig to version 4.1.1. The fix is identified as patch 9b6311161e346d7626c81d993044072fed2dca07.