Tóm tắt nhanh
- CVE-2026-46421 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.3) ảnh hưởng @cap-js/db-service, @cap-js/postgres, @cap-js/sqlite.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.52%, cao hơn 44.4% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 2.11.0, 2.3.0 hoặc mới hơn.
Mô tả
Impact
On April 29, 2026, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected] were published.
The malicious packages harvested credentials and attempted self-propagation.
If a compromised version was installed, all credentials accessible on that machine (npm tokens, cloud provider credentials, SSH keys, GitHub PATs) should be considered compromised.
Patches
Upgrade to @cap-js/sqlite >= 2.4.0, @cap-js/postgres >= 2.3.0, @cap-js/db-service >= 2.11.0.
If a compromised version was ever installed, rotate all affected credentials.
Workarounds
No workarounds.
Mô tả của NVD
The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database services for that tool. On April 29, 2026, compromised versions of `@cap-js/[email protected]`, `@cap-js/[email protected]`, and `@cap-js/[email protected]` were published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credentials accessible on that machine (npm tokens, cloud provider credentials, SSH keys, GitHub PATs) should be considered compromised. User should upgrade to `@cap-js/sqlite` >= 2.4.0, `@cap-js/postgres` >= 2.3.0, `@cap-js/db-service` >= 2.11.0. If a compromised version was ever installed, rotate all affected credentials. No known workarounds are available.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí