IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an OS command injection vulnerability (CWE-78) that permits a remote authenticated attacker to execute arbitrary code on the underlying operating system. The vulnerability arises from improper neutralization of special elements used in OS commands, enabling injection of malicious commands. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote authenticated attackers to execute arbitrary OS commands, potentially leading to full system compromise including data theft, modification, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is not a cloud service, IBM or the user must apply any available patches once released. Until then, restrict access to trusted users and monitor for suspicious activity related to command execution.