CSS Injection via setThemeRoot() in SAPUI5

Executive Summary

CVE-2026-44767 is a vulnerability in the setThemeRoot() function of the @ui5/webcomponents-base npm package, affecting versions prior to 2.21.0. The function fails to properly enforce the sap-allowed-theme-origins allowlist, which is meant to restrict the origins of theme resources.

An attacker can exploit this by providing an attacker-controlled absolute cross-origin URL, which can be stored and later used to construct a <link rel=stylesheet> element. This bypass works even when no <meta name=sap-allowed-theme-origins> tag is present in the document. The vulnerability can also be triggered via the ?sap-themeRoot URL parameter.

Exploitation requires attacker-influenced input, such as a URL query parameter, tenant configuration, or user-supplied setting, to reach the setThemeRoot() function. A successful exploit allows the attacker to inject arbitrary CSS into the victim's page.

• UI redressing and clickjacking
• Phishing overlays
• Visual defacement
• Limited data exfiltration via CSS attribute selectors targeting predictable DOM content

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for the presence of vulnerable versions of the @ui5/webcomponents-base package or SAP applications using the setThemeRoot() function without proper enforcement of the sap-allowed-theme-origins allowlist.

• Check installed versions of @ui5/webcomponents-base: Run 'npm list @ui5/webcomponents-base' in your project directory to verify if a version prior to 2.21.0 is installed.
• Inspect network traffic for unexpected or attacker-controlled theme URLs: Monitor HTTP requests for the 'sap-themeRoot' parameter or cross-origin URLs in theme-related requests.
• Review application configurations: Look for tenant configurations or user-supplied settings that might influence theme URLs without proper validation.
• Check for missing or misconfigured meta tags: Search for the absence of '<meta name=sap-allowed-theme-origins>' in HTML documents, which could indicate a lack of allowlist enforcement.

No specific commands are provided in the context for automated detection, but manual inspection of package versions, network logs, and application configurations is recommended.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are using an affected version of the @ui5/webcomponents-base package or a product that relies on it.

• An attacker could manipulate the appearance of your application, leading to UI redressing or clickjacking attacks. This could trick users into performing unintended actions.
• Phishing overlays could be injected, making it appear as though legitimate login forms or prompts are displayed, potentially stealing user credentials.
• Visual defacement could damage the reputation of your application or organization by altering its appearance or displaying unwanted content.
• Limited data exfiltration is possible through CSS attribute selectors, which could allow an attacker to extract sensitive information from the DOM if predictable patterns exist.

The impact is particularly concerning for applications that handle sensitive user data or rely on user trust for critical operations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could affect compliance with several common standards and regulations, depending on the context in which the affected software is used.

• GDPR (General Data Protection Regulation): If the vulnerability leads to unauthorized access or exfiltration of personal data, it could result in a violation of GDPR. The regulation requires organizations to implement appropriate technical measures to protect personal data. Failure to patch or mitigate this vulnerability could be seen as a lapse in these measures, potentially leading to fines or legal action.
• HIPAA (Health Insurance Portability and Accountability Act): For organizations handling protected health information (PHI), this vulnerability could pose a risk if it allows unauthorized access or manipulation of PHI. HIPAA requires safeguards to ensure the confidentiality, integrity, and availability of PHI. Exploitation of this vulnerability could be considered a breach of these safeguards.
• Other standards like PCI DSS (Payment Card Industry Data Security Standard) could also be impacted if the vulnerability is exploited in a system that processes payment card data, as it could lead to unauthorized access or manipulation of sensitive information.

Organizations should assess the risk posed by this vulnerability in their specific environment and take appropriate steps to mitigate it, such as applying patches or implementing compensating controls like a Content Security Policy (CSP).

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade the @ui5/webcomponents-base package to version 2.21.0 or later, as this version includes a patch that separates raw configuration storage from validated URL usage and blocks cross-origin absolute URLs unless explicitly allowed.
• Implement a Content Security Policy (CSP) to restrict stylesheet sources. For example, use 'style-src' directives to allow only trusted origins for loading CSS resources.
• Ensure that the '<meta name=sap-allowed-theme-origins>' tag is present in HTML documents and properly configured to restrict theme origins to trusted domains.
• Review and validate all tenant configurations and user-supplied settings that influence theme URLs to ensure they adhere to the allowlist.
• Monitor and block unexpected or suspicious theme-related requests, especially those containing cross-origin URLs or the 'sap-themeRoot' parameter.

Useful 0 Not Useful 0