CVE-2026-40131
SQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy library
Vexday Risk Score
8Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 3.4EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
12 May 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user input without proper parameterization or prepared statements. Successful exploitation could allow the high privileged users to alter the SELECT statements impacting confidentiality and availability of the application. There is no impact on integrity.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L
Affected products
SAP_SE · SAP HANA Deployment Infrastructure (HDI) deploy libraryWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →