An SQL injection flaw exists in the @sap/hdi-deploy package used by SAP HANA Deployment Infrastructure (HDI). The flaw allows dynamically built SELECT queries to include unsanitized user input, enabling an attacker who has elevated privileges to modify which data is returned, thereby leaking sensitive information or disrupting application functionality. The description explicitly states that the vulnerability does not affect integrity, but it can compromise data confidentiality and availability for users of the application.

The affected product is the SAP HANA Deployment Infrastructure (HDI) deploy library, provided by SAP SE. All installations that include the @sap/hdi-deploy component are at risk; no specific version ranges are listed in the CNA data, so all deployed instances should be considered potentially vulnerable unless known to be on a patched version.

The CVSS score of 3.4 indicates a moderate severity; no EPSS score is available, so the likelihood of exploit is not quantified. Because the issue requires high‑privileged user context to execute the manipulated SELECT statements, it is likely a local or privileged‑user attack rather than a remote public exploitation. The vulnerability is not currently in the CISA KEV collection, reducing the indication of active exploitation, but the risk remains for insider or compromised administrative accounts.