핵심
SAP AI and BusinessObjects integrations often sit near enterprise data and scheduling workflows. Affected sap-ai-sdk-base evidence matters because the advisory involves an OS command-execution boundary, but repository dependency evidence alone cannot prove BusinessObjects deployment, Program Object settings, or authenticated scheduling rights.
어떻게 동작하나요
The repo check looks for the PyPI `sap-ai-sdk-base` package in Python dependency manifests and lockfiles. Exact lockfile pins produce the strongest signal; broader manifest ranges are reported when they clearly allow versions through 3.3.0.
피해 범위
If the affected SAP BusinessObjects conditions are present, authenticated users with scheduling rights may reach a command-execution path. A repo match should drive dependency review, SAP platform remediation, Program Object execution review, and scheduling-rights review before anyone treats it as confirmed exploitability.
// fixvibe가 검사하는 항목
FixVibe가 검사하는 항목
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
확실한 방어
Move `sap-ai-sdk-base` off versions through 3.3.0 using vendor-supported guidance, regenerate the active Python lockfile, and rebuild every runtime that installs it. Where SAP BusinessObjects is deployed, apply the relevant SAP remediation, disable or tightly restrict Program Object execution, and limit scheduling rights to trusted operators.