IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.9 contain a flaw that allows a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements that are used in an OS command. The vulnerability exists when the application constructs and runs the command without adequate sanitization of user‑supplied data.

IBM TRIRIGA Application Platform (IBM:TRIRIGA Application Platform) with releases 5.0.0 through 5.0.9 is affected. These releases are identified in the CPE list as ibm:tririga_application_platform. Customers using these versions should be aware that the vulnerability is present until they upgrade beyond 5.0.9.

The CVSS score of 8.8 classifies this vulnerability as high severity. The EPSS score is not available, so the exploitation probability cannot be quantified. It is not listed in the CISA KEV catalog, indicating no known active exploitation at the time of this analysis. The likely attack vector is a remote authenticated attacker who can supply input that is then injected into an OS command. Successful exploitation would allow code execution on the server hosting IBM TRIRIGA Application Platform.