medium2026-10-13SAPUI5 — URL validationCVE-2026-89106
XSS via Unsafe URL Allowlist Configuration in SAPUI5
SAPUI5
Our Take
Part of this is configuration hygiene rather than code. Read the note for manual steps before assuming the patch is the whole job.
Vulnerability Detail
Cross-site scripting when URL validation relies on an unsafe allowlist configuration.
Patch Action
Apply SAP Note 3799054 and review your URL allowlist entries. The note may require configuration changes beyond the patch itself.
Affected Versions
SAP_UI 754 (minimum 1.71.85); other tracks per note
Patch Info