CVE-2026-17102
HighCVSS 8.8Summary
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Risk Assessment
An authenticated attacker could execute arbitrary system commands, potentially leading to system compromise and data breach.
Recommendation
It is recommended to strengthen input validation, avoid building OS commands from user data, and apply patches from IBM.
Other vulnerabilities in IBM DataStage
See all- CVE-2026-16672High
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- CVE-2026-16469High
IBM DataStage on Cloud Pak for Data 5.4.0.0 px-runtime could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- CVE-2026-16468High
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an OS command injection vulnerability that allows a remote authenticated attacker to execute arbitrary commands.
- CVE-2026-16346Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
- CVE-2026-16338Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths.
- CVE-2026-16673High
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains improper neutralization of special characters in the PxPeek name property. A remote authenticated attacker could exploit this to execute arbitrary OS commands.
- CVE-2026-16466High
IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to OS command injection. A remote authenticated attacker could exploit this to execute arbitrary commands.
- CVE-2026-16432High
The PxXMLInput operator in IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to XML external entity (XXE) injection. A remote authenticated attacker could exploit this to obtain sensitive information.
- CVE-2026-16428High
IBM DataStage on Cloud Pak for Data 5.4.0.0 has an improper configuration of the XSLT transformation engine. A remote authenticated attacker could exploit this to execute arbitrary code.
- CVE-2026-16335High
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability. A remote authenticated attacker could exploit this to read, write, or delete arbitrary files.
Original NVD description (English source)
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.