This vulnerability in pig-mesh Pig up to version 3.9.2 involves a code injection flaw in the pig-codegen component's GeneratorServiceImpl.java file. The flaw allows remote attackers to manipulate the affected functionality to inject arbitrary code. Exploits are publicly available, but the vendor has not provided any response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation could allow remote attackers to execute arbitrary code within the context of the affected application, potentially leading to unauthorized actions or system compromise. However, the impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. No known exploits in the wild have been reported.

No official patch or remediation is currently available as the vendor has not responded to the disclosure. Users should monitor vendor communications for updates. Until a fix is released, consider restricting network access to the vulnerable component and applying any available compensating controls to limit exposure.