概要
SAP AI and BusinessObjects integrations often sit near enterprise data and scheduling workflows. Affected sap-ai-sdk-base evidence matters because the advisory involves an OS command-execution boundary, but repository dependency evidence alone cannot prove BusinessObjects deployment, Program Object settings, or authenticated scheduling rights.
仕組み
The repo check looks for the PyPI `sap-ai-sdk-base` package in Python dependency manifests and lockfiles. Exact lockfile pins produce the strongest signal; broader manifest ranges are reported when they clearly allow versions through 3.3.0.
被害範囲
If the affected SAP BusinessObjects conditions are present, authenticated users with scheduling rights may reach a command-execution path. A repo match should drive dependency review, SAP platform remediation, Program Object execution review, and scheduling-rights review before anyone treats it as confirmed exploitability.
// fixvibeのチェック内容
FixVibeのチェック内容
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
鉄壁の防御
Move `sap-ai-sdk-base` off versions through 3.3.0 using vendor-supported guidance, regenerate the active Python lockfile, and rebuild every runtime that installs it. Where SAP BusinessObjects is deployed, apply the relevant SAP remediation, disable or tightly restrict Program Object execution, and limit scheduling rights to trusted operators.