SQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy library
CVE-2026-40131

3.4LOW

Key Information:

Vendor

SAP
Status
SAP Hana Deployment Infrastructure (hdi) Deploy Library
Vendor
CVE Published:
12 May 2026

What is CVE-2026-40131?

SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user input without proper parameterization or prepared statements. Successful exploitation could allow the high privileged users to alter the SELECT statements impacting confidentiality and availability of the application. There is no impact on integrity.

Affected Version(s)

SAP HANA Deployment Infrastructure (HDI) deploy library XS_HDI_DEPLOYER 1.00

References

https://me.sap.com/notes/3726962
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
3.4
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.