Code Injection in Pig-Mesh Pig Visual Component

Executive Summary

CVE-2026-15512 is a critical remote code execution (RCE) vulnerability in the pig-mesh PIG microservice platform, specifically affecting versions up to 3.9.2. The flaw exists in the pig-codegen module, which uses the Apache Velocity template engine to render user-defined templates without proper security controls.

Attackers can exploit this vulnerability by injecting malicious Velocity templates through the template management API. This injection bypasses access restrictions using Java reflection, allowing execution of arbitrary system commands remotely.

The attack involves sending a PUT request with a malicious payload to update a template, which is then stored in the database. A subsequent GET request to the /generator/preview endpoint retrieves and executes the malicious template, triggering remote code execution.

Successful exploitation can create files on the server, demonstrating full control over the system via the vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to remotely execute arbitrary code on the affected system, potentially leading to full system compromise.

• Attackers can run system commands, manipulate files, and control the server environment.
• It can lead to unauthorized access, data theft, service disruption, or use of the compromised system as a launchpad for further attacks.
• Because the exploit is publicly available, the risk of exploitation is high.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to exploit the template injection via the pig-codegen module's template management API. Specifically, you can send a crafted PUT request to update a template with a malicious Velocity template payload that executes a system command, such as creating a file. Then, a GET request to the /generator/preview endpoint can trigger the execution of the injected template.

• Send a PUT request with a payload like: #set($x=$math.getClass().forName('java.lang.Runtime').getRuntime().exec('touch /tmp/pwned')) to the template management API.
• Send a GET request to /generator/preview to trigger the execution of the malicious template.

If the file /tmp/pwned is created on the system, it confirms successful exploitation and presence of the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the template management API and the /generator/preview endpoint to trusted users only, as the vulnerability allows remote code execution via template injection.

Avoid using unfiltered or unsafe template engines like Apache Velocity with user-defined templates without proper security controls.

Monitor and audit template updates for suspicious payloads or unexpected changes.

If possible, apply patches or updates from the vendor once available, or consider disabling the vulnerable pig-codegen component until a fix is released.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows remote code execution through unfiltered template injection, which can lead to unauthorized access and manipulation of system resources.

Such unauthorized access and potential data breaches could negatively impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and secure system operations.

However, the provided information does not explicitly mention the direct impact on compliance with these standards.

Useful 0 Not Useful 0