IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an OS command injection flaw that allows a remote authenticated attacker to execute arbitrary commands. The vulnerability results from improper neutralization of special elements in shell command strings, which can lead to execution of system commands with the privileges of the vulnerable service. This capability can compromise confidentiality by leaking sensitive data, integrity by modifying or deleting files, and availability by disrupting services. The flaw is identified by CWE-78.

Affected systems are IBM's DataStage on Cloud Pak for Data product, version 5.4.0.0. The vulnerability exists only in this exact release and affects environments that use this version without the later patch.

The CVSS score of 8.8 indicates high severity, and the lack of an EPSS score means an exploitation probability cannot be quantified but the flaw remains serious. The vulnerability is not listed in CISA’s KEV catalog, indicating no public exploits are actively used yet. Attack requires authenticated access to the DataStage instance, implying internal or privileged attack vectors. Once authenticated, an attacker can supply crafted input that is routed to an OS shell, leading to arbitrary command execution. Consequently, the risk is high for environments where the vulnerable version is deployed and credentials are available.