GitHub Advisoryadvisory · PyPI

GHSA-xxhh-59gh-6ffx SAP Cloud SDK for AI Python has OS Command Injection when Program Objects Execution is Enabled

HIGH Published 2023-03-14 Modified 2026-06-09 Official page ↗
Aliases
CVE-2023-25617
Ecosystem
PyPI
Packages
sap-ai-sdk-base
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74, CWE-78
Reviewed
2026-06-09

Affected packages

• PyPI sap-ai-sdk-base: <= 3.3.0 (no fix yet)

Description

SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling rights, using the BI Launchpad, Central Management Console or a custom application based on the public java SDK. Programs could impact the confidentiality, integrity and availability of the system.

Related

Alias · CVE (1)

  • CVE-2023-25617 SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects… vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References