CVE-2026-40131

{
  "id": "CVE-2026-40131",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T03:16:11.910",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user input without proper parameterization or prepared statements. Successful exploitation could allow the high privileged users to alter the SELECT statements impacting confidentiality and availability of the application. There is no impact on integrity."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección SQL existe en el paquete @sap/hdi-deploy, donde las consultas SQL se construyen dinámicamente utilizando la entrada del usuario sin una parametrización adecuada o sentencias preparadas. Una explotación exitosa podría permitir a los usuarios con altos privilegios alterar las sentencias SELECT impactando la confidencialidad y disponibilidad de la aplicación. No hay impacto en la integridad."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP HANA Deployment Infrastructure (HDI) deploy library",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "XS_HDI_DEPLOYER 1.00",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L",
          "baseScore": 3.4,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T13:10:51.330853Z",
          "id": "CVE-2026-40131",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://me.sap.com/notes/3726962",
      "source": "[email protected]"
    },
    {
      "url": "https://url.sap/sapsecuritypatchday",
      "source": "[email protected]"
    }
  ]
}