pig-mesh Pig EUVD-2026-43253

Exploitation requires an authenticated session with at minimum low-privilege credentials on the pig-mesh Pig application - unauthenticated exploitation is not possible per the PR:L rating in the CVSS 4.0 vector. The vulnerable attack surface is specifically the pig-codegen code generation functionality exposed through GeneratorServiceImpl; deployments that do not include or expose this module are not affected. No user interaction beyond the attacker's own crafted request is required (UI:N), and no additional attack complexity or specialized conditions are specified (AC:L, AT:N). The primary limiting factors are: (1) the requirement for at least one valid low-privilege credential, limiting mass exploitation against systems with strong credential hygiene; and (2) the pig-codegen module must be deployed and reachable - it may not be present in all pig-mesh Pig installations. The vendor's non-response means it is unknown whether the default installation includes pig-codegen enabled by default.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with impact metrics VC:L/VI:L/VA:L yields a base score of 5.3, which appears to understate real-world severity given the RCE tag and CWE-94 classification - code injection vulnerabilities routinely enable full server compromise. This discrepancy between the CVSS impact assessment (Low across all pillars) and the RCE characterization is a notable inconsistency that has not been independently resolved by a vendor advisory. The CVSS E:P modifier confirms a proof-of-concept exploit is available, which materially increases exploitation likelihood. No EPSS score was provided in the input. The vulnerability is not currently listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The combination of a public exploit, no patch, and vendor non-response represents a meaningful real-world risk to organizations running pig-codegen in internet-accessible or multi-tenant environments, despite the moderate CVSS score.

An attacker with a low-privilege account on a pig-mesh Pig deployment navigates to the pig-codegen code generation interface and submits a crafted HTTP request to the GeneratorServiceImpl endpoint containing a malicious template or scripting payload embedded in the code generation parameters. The server processes the payload without adequate sanitization, resulting in arbitrary Java code execution under the application server's runtime context. The publicly available proof-of-concept at https://github.com/sombra0316/CVE-2026/blob/main/pig-mesh/SSIT.md provides a ready-made exploitation template, lowering the attacker skill barrier significantly.