A critical OS command injection vulnerability in IBM DataStage on Cloud Pak for Data allows authenticated remote attackers to achieve arbitrary command execution on the host system.

This is an OS command injection flaw (CWE-78) located within the px-runtime component, which permits a remote authenticated attacker to execute arbitrary commands by injecting malicious input into system calls.

Successful exploitation of this vulnerability enables a remote attacker to execute arbitrary system-level commands with the privileges of the application runtime. Given the CVSS score of 8.8, this poses a high risk of complete system compromise, unauthorized data access, and potential lateral movement within the environment.

Immediate Action: Upgrade DataStage on Cloud Pak for Data to version 5.4 patch 7 or later according to the official IBM documentation.

Proactive Monitoring: Review system and application access logs for suspicious shell commands or unusual child processes originating from the DataStage runtime environment.

Compensating Controls: Implement strict network segmentation and egress filtering to limit the potential reach of an attacker if command execution is achieved.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a significant risk to the integrity and availability of the affected IBM DataStage infrastructure. Security teams should prioritize the deployment of the 5.4 patch 7 update to remediate the underlying command injection flaw and prevent potential unauthorized system access.