VULNERABILITY INTELLIGENCE
CVE-2026-40131
CVSS score3.4 LOW
EPSS probability0.17%
CISA KEVNot currently listed
Published2026-05-12
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L
Description
SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user input without proper parameterization or prepared statements. Successful exploitation could allow the high privileged users to alter the SELECT statements impacting confidentiality and availability of the application. There is no impact on integrity.
Weakness classification
- cna@sap.com: CWE-89