sdk vulnerability