This vulnerability in DTStack Taier 1.4.0 involves improper handling of the sqlText argument in the REST API's Runtime.exec function, allowing an attacker to inject and execute arbitrary operating system commands remotely. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability. The vendor has not provided a patch or official remediation, and the vulnerability remains unmitigated as of the publication date.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected system with low privileges, potentially leading to unauthorized system access or control. The impact on confidentiality, integrity, and availability is rated as low, but the ability to execute OS commands can facilitate further attacks or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the REST API component, applying network-level controls to limit exposure, and monitoring for suspicious activity related to sqlText inputs. Avoid exposing the vulnerable version to untrusted networks until a patch or official mitigation is released.