An attacker with valid credentials can trigger the execution of arbitrary operating system commands due to insufficient sanitization of special characters in a command string. The flaw permits the attacker to compromise the confidentiality, integrity, and availability of the underlying system, potentially gaining full control. The vulnerability is an example of OS command injection (CWE‑78).

IBM DataStage on Cloud Pak for Data at version 5.4.0.0 is affected. IBM explicitly recommends upgrading to 5.4 patch 7 or later, following the vendor‑provided instructions.

The CVSS score of 8.8 indicates high severity, while the EPSS score is < 1%, suggesting a low exploitation probability, and the issue is not listed in the CISA KEV catalog. The attack vector is remote; a legitimate user that connects to the DataStage service and submits data that includes malicious command fragments can directly exploit the flaw. Because authentication is required, the risk for attackers without credentials is lower, but credential compromise would expose the system to critical exploitation.