Code Execution Vulnerability in SAP App Studio Toolkit

CVE-2026-89116

What is CVE-2026-89116?

The SAP App Studio Toolkit contains a vulnerability that allows an attacker to execute arbitrary operating system commands due to improper handling of the workspace configuration. Specifically, it uses child_process.execSync to handle generator installation and uninstallation with a user-controlled shell string, making it susceptible to OS command injection. A compromised settings.json file within a malicious workspace could exploit this flaw when a developer opens the project, ultimately allowing an attacker to run commands with the developer’s privileges.

References