CVE-2026-40131
SQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy library
- State
- Published
- Severity
- 3.4 Low
- Published
- May 12, 2026
- Updated
- May 12, 2026
- Reserved
- Apr 9, 2026
Description
SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user input without proper parameterization or prepared statements. Successful exploitation could allow the high privileged users to alter the SELECT statements impacting confidentiality and availability of the application. There is no impact on integrity.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.4 Low | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L | sap |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Affected Products
| Product | Versions |
|---|---|
SAP HANA Deployment Infrastructure (HDI) deploy librarySAP_SE |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.