CVE-2021-31856

9.8 criticalEPSS 75%

Critical (9.8) in layer5 meshery. EPSS 75% chance of exploitation in the next 30 days.

A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint (order parameter in GetMesheryPatterns in models/meshery_pattern_persister.go).

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 75% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-11-01)
CWE: CWE-89
Published: 2021-04-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

layer5:meshery

References

https://github.com/layer5io/meshery/pull/2745
https://meshery.io
https://github.com/layer5io/meshery/pull/2745
https://meshery.io

Check your stack JSON