The hook
SAP AI and BusinessObjects integrations often sit near enterprise data and scheduling workflows. Affected sap-ai-sdk-base evidence matters because the advisory involves an OS command-execution boundary, but repository dependency evidence alone cannot prove BusinessObjects deployment, Program Object settings, or authenticated scheduling rights.
How it works
The repo check looks for the PyPI `sap-ai-sdk-base` package in Python dependency manifests and lockfiles. Exact lockfile pins produce the strongest signal; broader manifest ranges are reported when they clearly allow versions through 3.3.0.
The blast radius
If the affected SAP BusinessObjects conditions are present, authenticated users with scheduling rights may reach a command-execution path. A repo match should drive dependency review, SAP platform remediation, Program Object execution review, and scheduling-rights review before anyone treats it as confirmed exploitability.
// what fixvibe checks
What FixVibe checks
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Ironclad defenses
Move `sap-ai-sdk-base` off versions through 3.3.0 using vendor-supported guidance, regenerate the active Python lockfile, and rebuild every runtime that installs it. Where SAP BusinessObjects is deployed, apply the relevant SAP remediation, disable or tightly restrict Program Object execution, and limit scheduling rights to trusted operators.