Description

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special characters in the PxPeek name property.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-14T20:16:41.053Z",
  "pubdate": "2026-09-14T20:16:41.053Z",
  "executiveSummary": "A critical OS command injection vulnerability exists within IBM DataStage on Cloud Pak for Data 5.4.0.0. The vulnerability stems from the improper neutralization of special characters within the PxPeek name property, which allows an authenticated remote attacker to execute arbitrary OS commands on the underlying host system.\nThe vulnerability poses a severe risk to organizational security, as successful exploitation results in full remote code execution (RCE) with the privileges of the service account running the DataStage application. This could lead to unauthorized system access, data exfiltration, service disruption, and potential lateral movement within the Cloud Pak for Data cluster.\nExploitation requires the attacker to have valid authentication credentials for the environment. The threat originates from the lack of robust input validation mechanisms for user-supplied data processed by the PxPeek functionality. Organizations are advised to prioritize immediate remediation through vendor-provided patches or mitigations to minimize the exposure surface of their data integration pipelines.",
  "technicalDetails": "The vulnerability resides in the processing logic of the PxPeek component within IBM DataStage on Cloud Pak for Data 5.4.0.0. Specifically, the PxPeek name property fails to perform adequate input sanitization, allowing meta-characters to be interpreted by the underlying operating system shell during command execution.\nThe root cause is an improper neutralization of special characters, which occurs when user-supplied input provided to the PxPeek name property is concatenated into a system-level command string without prior validation or parameterization. Because the application fails to restrict the character set or escape shell-metacharacters (such as semicolons, pipes, backticks, or ampersands), an attacker can inject arbitrary shell commands into the input field.\nThe exploitation flow begins with the attacker authenticated to the IBM DataStage instance. By crafting a request that includes malicious shell operators within the PxPeek name property, the attacker can manipulate the command execution sequence. When the application invokes the vulnerable component to perform its diagnostic or inspection function, it inadvertently executes the injected payload in the context of the DataStage process owner.\nSince the execution occurs via the system shell, the attacker gains the ability to execute any command supported by the underlying OS. This privilege level typically grants the attacker full control over the application's environment, the ability to read or modify sensitive configuration files, execute network reconnaissance, or deploy malicious binaries on the host.\nBecause the PxPeek tool is integrated into the data processing flow, it acts as a gateway for attackers to break out of the application sandbox. The lack of strict boundary enforcement at the application-to-OS interface enables this command injection path. This vulnerability is particularly dangerous in cloud-native environments like Cloud Pak for Data, as compromising one pod or service instance can facilitate broader container escapes or unauthorized access to integrated storage volumes and internal microservices via existing network service meshes.\nPost-exploitation impact includes persistent access, installation of webshells, or escalation of privileges by leveraging local OS vulnerabilities. Given the nature of DataStage as a high-privilege integration hub, the potential for data breach and internal credential harvesting is significant."
}