The reported issue stems from an inappropriate use of Runtime.exec in the DTStack Taier REST API. By manipulating the sqlText argument, an attacker can inject arbitrary operating‑system commands. This vulnerability allows a remote attacker to execute code on the underlying host, potentially leading to full system compromise. The weakness is categorized as a command injection (CWE‑77 and CWE‑78) affecting the input handling within the API. No particular authentication or privilege is required beyond the ability to send requests to the exposed REST endpoint.

The flaw is present in DTStack Taier version 1.4.0. The vulnerability resides in the component that parses the sqlText parameter within the REST API layer. Users running this specific version of Taier are at risk unless they move to a later release in which the issue has been addressed. No other versions or sub‑components were identified as affected in the data provided.

The CVSS score of 5.3 classifies the flaw as moderate, while the EPSS score is not available, indicating no publicly available exploitation statistics at this time. The attack can be carried out remotely through the exposed API, and the vulnerability is publicly disclosed, which means a malicious actor could readily craft a payload. The vulnerability is not listed in CISA's KEV catalog, suggesting that no known exploits have been observed by the agency. Nevertheless, the nature of OS command injection warrants attention, as any unfiltered input could enable an attacker to run arbitrary commands with the privileges assigned to the Taier service.