SAP Fiori Launchpad does not sufficiently validate certain user-controlled input, leading to improper neutralization of directives in dynamically evaluated code (CWE-95). An unauthenticated attacker can create a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. This behavior can be exploited to exfiltrate sensitive information from the victim's session, resulting in a confidentiality impact. There is no impact on integrity or availability. The affected versions are exactly 758 and 816. No known exploits are reported in the wild. No patch or remediation information is provided in the source data.

The vulnerability allows an attacker to exfiltrate sensitive information from an authenticated user's session by tricking the user into clicking a crafted malicious link. This results in a high confidentiality impact. There is no impact on data integrity or system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should exercise caution with links and monitor vendor advisories for updates. No vendor advisory states that no action is required or that the issue is already mitigated.