Is there a public PoC exploit available for EUVD-2026-43253?

Yes, a public proof-of-concept exploit is available for EUVD-2026-43253. Prioritise patching immediately. EPSS: 0.4%.

pig-mesh Pig EUVD-2026-43253

Q: What is the CVSS score of EUVD-2026-43253?

EUVD-2026-43253 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-15512 LOW

Code Injection (CWE-94)

2026-07-12 VulDB

GHSA-5qr2-jcjw-v3xc

RCE Java Code Injection Pig

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Code injection enabling RCE justifies C:H/I:H/A:H; PR:L reflects authenticated access required per CVSS 4.0 source vector; AV:N and AC:L confirmed by the source vector with no additional attack requirements.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 13, 2026 - 00:22 NVD

MEDIUM LOW

CVSS changed

Jul 13, 2026 - 00:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 13, 2026 - 00:01 vuln.today

DescriptionCVE.org

A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen\src\main\java\com\pig4cloud\pig\codegen\service\impl\GeneratorServiceImpl.java of the component pig-codegen. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Remote code injection in pig-mesh Pig's pig-codegen module through version 3.9.2 allows low-privileged authenticated attackers to execute arbitrary code server-side via the GeneratorServiceImpl component, reachable over the network. A publicly available proof-of-concept exploit exists at GitHub (sombra0316/CVE-2026), elevating the urgency for defenders. No vendor patch has been released, and the vendor did not respond to responsible disclosure, leaving affected deployments without an official remediation path.

Technical ContextAI

pig-mesh Pig is an open-source Java-based microservice rapid development framework (pig4cloud/pig) commonly used in enterprise application development, particularly within Chinese developer communities. The vulnerable component, pig-codegen, is a code generation module that processes user-supplied input through GeneratorServiceImpl.java to produce source code from templates. CWE-94 (Improper Control of Generation of Code) describes the root cause: unsanitized or insufficiently controlled user input is passed into a code generation or template rendering pipeline - in Java frameworks this typically manifests as Server-Side Template Injection (SSTI) via engines such as Velocity or FreeMarker, or misuse of javax.script.ScriptEngine APIs. The CPE cpe:2.3:a:pig-mesh:pig:*:*:*:*:*:*:*:* covers all versions up to the reported ceiling of 3.9.2. The affected file path (pig-master\pig-visual\pig-codegen\src\main\java\com\pig4cloud\pig\codegen\service\impl\GeneratorServiceImpl.java) directly implicates the service-layer implementation of code generation logic.

RemediationAI

No vendor-released patch identified at time of analysis - the vendor did not respond to disclosure, and no fixed version number has been confirmed. As compensating controls: restrict access to the pig-codegen code generation endpoints exclusively to trusted administrative users at the application or API gateway layer, since the vulnerability requires at minimum low-privilege authenticated access (PR:L). If code generation functionality is not used in production, disable or remove the pig-codegen module entirely from the deployment - this eliminates the attack surface with no functional trade-off for non-users. Apply network-layer controls (firewall rules, VPN-gated access) to prevent internet-facing exposure of the GeneratorServiceImpl endpoint. Monitor application logs for anomalous or unexpected code generation requests as a detection measure. Track the VulDB entry at https://vuldb.com/vuln/377841 and the project repository for any future patch release.