CVE-2026-46421

Deferred Deferred - Pending Action

Malicious Package in SAP Cloud Application Programming Model

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database services for that tool. On April 29, 2026, compromised versions of `@cap-js/[email protected]`, `@cap-js/[email protected]`, and `@cap-js/[email protected]` were published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credentials accessible on that machine (npm tokens, cloud provider credentials, SSH keys, GitHub PATs) should be considered compromised. User should upgrade to `@cap-js/sqlite` >= 2.4.0, `@cap-js/postgres` >= 2.3.0, `@cap-js/db-service` >= 2.11.0. If a compromised version was ever installed, rotate all affected credentials. No known workarounds are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-46421

Affected Vendors & Products

Vendor	Product	Version / Range
cap-js	sqlite	From 2.4.0 (inc)
cap-js	postgres	From 2.3.0 (inc)
cap-js	db-service	From 2.11.0 (inc)
sap	mbt	1.2.48

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-506	The product contains code that appears to be malicious in nature.

Attack-Flow Graph

Executive Summary

This vulnerability involves compromised npm packages (@cap-js/[email protected], @cap-js/[email protected], @cap-js/[email protected]) published on April 29, 2026. These packages contained malicious code designed to harvest credentials like npm tokens, cloud provider credentials, SSH keys, and GitHub PATs from infected systems. They also attempted to self-propagate to spread the compromise further.

Detection Guidance

Check installed npm packages for compromised versions using commands like 'npm list @cap-js/sqlite', 'npm list @cap-js/postgres', and 'npm list @cap-js/db-service'. Look for versions 2.2.2, 2.2.2, or 2.10.1 respectively. Review system logs for unusual preinstall hook executions or network connections to suspicious domains.

Impact Analysis

If you installed any of the compromised versions, your system's credentials are likely compromised. Attackers can access sensitive data, manipulate cloud resources, or propagate the attack to other systems. Immediate credential rotation is required to prevent unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations must rotate compromised credentials and assess potential data breaches.

Mitigation Strategies

Immediately upgrade affected packages to patched versions: @cap-js/sqlite >=2.4.0, @cap-js/postgres >=2.3.0, @cap-js/db-service >=2.11.0. Rotate all credentials accessible on the compromised system including npm tokens, cloud provider credentials, SSH keys, and GitHub PATs.

Hi! I’m here to help you understand CVE-2026-46421. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70