AIKIDO-2026-760121

TL;DR

@ui5/webcomponents-base builds a theme CSS <link> from the configurable themeRoot value in validateThemeRoot. The origin check treats any value that starts with / as a same-origin relative path, so a protocol-relative URL such as //attacker.example/path is resolved against the page origin and skips the sap-allowed-theme-origins allowlist entirely. An application that derives themeRoot from attacker-influenced input then inserts a stylesheet link pointing at an external, attacker-controlled origin, loading untrusted CSS into the page. The fix excludes protocol-relative URLs from the relative-path branch and routes them through the origin allowlist validation.