A DOM‑based Cross‑Site Scripting flaw allows an attacker to craft a malicious link that, when accessed by an authenticated SAPUI5 user, causes the browser to execute attacker‑supplied script. The code is injected directly into the page’s DOM without sanitization, enabling the attacker to read or modify data stored in the victim’s browser context, thereby compromising confidentiality and integrity of client‑side information. Availability is not affected because the vulnerability does not disrupt the system’s operation.

The flaw targets SAP SE's SAPUI5 component, specifically the Support Assistant Overlay. No explicit version ranges are provided; impacted installations of SAPUI5 that include this overlay are considered vulnerable.

The CVSS score of 6.1 indicates moderate severity. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated attacker to distribute the malicious link and an authenticated user to click it. Because the attack is client‑side, the risk is confined to the victim’s browser session but can still lead to credential theft or data manipulation if the attacker controls enough content.