Vulnerability · Published May 25, 2026 · Assigned by VulDB

CVE-2026-9437DTStack Taier REST API Runtime.exec os command injection

Medium 6.3

In plain English

A medium-severity OS command injection in Taier from DTStack. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)2.2%top 17.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in DTStack Taier 1.4.0. This affects the function Runtime.exec of the component REST API. The manipulation of the argument sqlText leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
DTStack	Taier	1.4.0

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-365418 | DTStack Taier REST API Runtime.exec os command injection vdb-entry, technical-description
VDB-365418 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #813941 | DTStack Taier 1.4.0 Code Injection third-party-advisory
https://github.com/fakebug111/my_public_bug/blob/main/issus02.md exploit