IBM DataStage on Cloud Pak for Data version 5.4.0.0 contains an OS command injection vulnerability (CWE-78) that could allow a remote attacker with authentication privileges to execute arbitrary OS commands. This occurs because the product does not properly neutralize special elements used in OS commands, enabling command injection. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation could lead to full compromise of the affected system, including unauthorized command execution with the privileges of the authenticated user. This can result in complete loss of confidentiality, integrity, and availability of the system running IBM DataStage on Cloud Pak for Data 5.4.0.0.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM's advisories for updates. In the meantime, restrict access to the affected version to trusted users only and consider additional network-level controls to limit exposure.