{"action":"Upgrade @cap-js/db-service to 2.11.0 or later.","affected":[{"fixed":"2.11.0","introduced":"2.10.1"}],"component":"@cap-js/db-service","cve_ids":["CVE-2026-46421"],"ecosystem":"npm","epss":0.00524,"exploited":false,"fixed_versions":["2.11.0"],"ghsa_id":"GHSA-pvw4-cvr4-97p8","id":"tcs_01M5KG4J2TXMJGSW2ZNZP5799P","modified_at":"2026-09-10T03:51:06.701340290Z","published_at":"2026-05-20T15:33:04Z","references":["https://osv.dev/vulnerability/GHSA-pvw4-cvr4-97p8","https://github.com/cap-js/cds-dbs/security/advisories/GHSA-pvw4-cvr4-97p8","https://github.com/cap-js/cds-dbs","https://me.sap.com/notes/3747787","https://www.sap.com/documents/2026/05/8203a8b9-4d7f-0010-bca6-c68f7e60039b.html","https://www.stepsecurity.io/blog/a-mini-shai-hulud-has-appeared"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-pvw4-cvr4-97p8#npm/@cap-js/db-service","url":"https://osv.dev/vulnerability/GHSA-pvw4-cvr4-97p8"},{"source":"nvd","source_id":"CVE-2026-46421","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46421"}],"summary":"Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)"}