Skip to content
OpenAdvisories

Product · SAP

@ui5/webcomponents-base

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.1
    CVE-2026-44767

    Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection

    setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a <link rel=stylesheet> element, even when no <meta name=sap-allowed-theme-origins> tag w…

    SAP @ui5/webcomponents-base