Executive brief
pig-mesh Pig is a microservice development platform. A security vulnerability in its code generation component allows an attacker with basic user privileges to execute malicious commands on the server. This could lead to a full system takeover, unauthorized data access, or disruption of the development environment.
Technical details
A Server-Side Template Injection (SSTI) vulnerability exists in the pig-codegen module of pig-mesh Pig versions up to 3.9.2. The vulnerability is located in the GeneratorServiceImpl.java file, where the application uses the Apache Velocity template engine to render user-defined templates without proper sanitization or sandbox isolation. An attacker with low privileges can submit a malicious payload (e.g., using Java reflection via $math.getClass().forName('java.lang.Runtime')) through the template management API. When the template is subsequently previewed or processed by the VelocityKit utility, the injected code is executed, leading to Remote Code Execution (RCE). The vendor has not yet released a patch.
Affected products
- pig-mesh Pig up to 3.9.2
Timeline
- 2026-07-13: advisory: NVD publication date
- 2026-07-12: disclosed: Initial disclosure by VulDB and public exploit availability