Description

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary code due to improper configuration of the XSLT transformation engine.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-14T20:16:40.537Z",
  "pubdate": "2026-09-14T20:16:40.537Z",
  "executiveSummary": "This vulnerability involves a critical flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0, specifically regarding the configuration of the Extensible Stylesheet Language Transformations (XSLT) engine.\nThe vulnerability is categorized as an improper configuration of a transformation engine, which enables a remote authenticated attacker to execute arbitrary code on the underlying host system.\nSuccessful exploitation allows for complete compromise of the affected DataStage instance, potentially leading to unauthorized data access, system disruption, or lateral movement within the Cloud Pak for Data environment.\nThe attack requires the adversary to have authenticated access to the platform, after which they can leverage the insecure XSLT configuration to bypass security controls and execute system-level commands or code.\nGiven the nature of code execution, this represents a high-risk security flaw that necessitates immediate administrative attention to prevent unauthorized system manipulation.",
  "technicalDetails": "The vulnerability resides within the XSLT processing logic implemented within IBM DataStage on Cloud Pak for Data 5.4.0.0. The root cause is identified as an improper configuration of the XSLT transformation engine, which fails to adequately sanitize or restrict features that are inherently dangerous when exposed to user-controlled input.\nXSLT engines often include extensions or features, such as the ability to call external system functions, access local files, or initiate network connections (e.g., via the 'document()' function in XSLT 1.0 or similar mechanisms in later versions). When these features are not explicitly disabled or locked down via secure sandbox configurations, an attacker can supply a malicious XSLT stylesheet designed to trigger these functions.\nThe attack flow proceeds as follows: An authenticated attacker submits a crafted XSLT payload to the vulnerable DataStage component. The transformation engine parses the malicious stylesheet, and because of the improper configuration, it treats the embedded malicious commands as legitimate processing instructions. This allows the attacker to invoke system-level functions or external binaries that interact with the host operating system.\nBecause the XSLT processor runs with the permissions of the DataStage application service account, any code executed through this vector inherits those privileges. This effectively provides the attacker a conduit to execute arbitrary commands, read sensitive configuration files, or manipulate data processing pipelines without authorization.\nThis vulnerability is restricted to remote authenticated users, meaning the attacker must first bypass initial authentication mechanisms to interact with the DataStage interface. Once authenticated, the network exposure is inherent to the application's design, as the transformation engine is reachable through standard DataStage integration points.\nPost-exploitation impact is severe, as arbitrary code execution allows for persistence, privilege escalation (if the service account is over-privileged), and full control over the DataStage processing logic. The lack of proper containment around the XSLT transformation process permits an attacker to escape the expected functional scope of the data integration tasks."
}