IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a CWE-94 (Improper Control of Generation of Code) vulnerability due to improper configuration of the XSLT transformation engine. This misconfiguration could allow a remote attacker with valid authentication to execute arbitrary code on the affected system. The vulnerability is classified with a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a remote authenticated attacker to execute arbitrary code, potentially leading to full compromise of the affected system, including unauthorized data access, modification, or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected system to trusted users only and monitor for suspicious activity related to XSLT transformations. Follow IBM's official communications for updates on patches or workarounds.