CVE-2021-31856

CRITICAL NUCLEI

Layer5 Meshery 0.5.2 - SQL Injection via /experimental/patternfiles Order Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-31856. PoCs published by ssst0n3. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2021-31856, a SQL injection vulnerability in Meshery's `GetMesheryPatterns` function. It includes a proof-of-concept (PoC) URL, code analysis, and a fix recommendation.

Description

A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint (order parameter in GetMesheryPatterns in models/meshery_pattern_persister.go).

Exploits (1)

nomisec WRITEUP
by ssst0n3 · poc
https://github.com/ssst0n3/CVE-2021-31856

This repository provides a detailed technical analysis of CVE-2021-31856, a SQL injection vulnerability in Meshery's `GetMesheryPatterns` function. It includes a proof-of-concept (PoC) URL, code analysis, and a fix recommendation.

Classification
Writeup 100%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Meshery v0.5.2
No auth needed
Prerequisites: Access to the Meshery API endpoint
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Nuclei Templates (1)

Layer5 Meshery 0.5.2 - SQL Injection
CRITICALby princechaddha

References (2)

Core 2
Core References
Product, Vendor Advisory x_refsource_misc
https://meshery.io
Patch, Third Party Advisory x_refsource_misc
https://github.com/layer5io/meshery/pull/2745

Scores

CVSS v3 9.8
EPSS 0.7538
EPSS Percentile 99.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
layer5/meshery 0.5.2
Published Apr 28, 2021
Tracked Since Feb 18, 2026