Threats affecting pkg:maven/pig

CVE-2026-125377 is a missing authorization vulnerability in pig-mesh's pig product prior to version 4.1.2. It allows authenticated users without proper client-management permissions to access OAuth2 client secrets via specific API endpoints. This can lead to unauthorized retrieval of sensitive clientSecret values and token acquisition using those clients' grant types.

CVE-2026-15512 is a code injection vulnerability in pig-mesh Pig affecting versions 3.9.0, 3.9.1, and 3.9.2. The issue exists in the pig-codegen component, specifically in GeneratorServiceImpl.java. The vulnerability allows remote attackers to inject code. The vendor has not responded to the disclosure, and no official patch or remediation is currently available. The CVSS 4.0 score rates this as a medium severity issue.