IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a flaw that allows a remote authenticated attacker to execute arbitrary scripts by sending a specially crafted X‑Forwarded‑Host header. The vulnerability arises from improper neutralization of input, enabling code execution in the application context. This is a remote code execution vulnerability (CWE‑79), which can lead to compromise of confidentiality, integrity, and availability of the affected system.

The affected product is IBM DataStage on Cloud Pak for Data, specifically version 5.4.0.0. Users running this legacy version are vulnerable unless they apply the recommended update.

The CVSS score of 4.4 indicates a moderate severity. The EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated to the DataStage environment and to supply a malicious X‑Forwarded‑Host header; therefore, the attack vector is remote authenticated. Because the flaw leads to arbitrary script execution, the potential impact is high if the attacker successfully exploits it, but the current risk rating reflects the need for authentication as a prerequisite.