Medium · 6.3 CVE-2025-13688 EUVD-2025-208261GHSA-g55j-73w9-5pc7

DataStage on Cloud Pak for Data is vulnerable to arbitrary code injection due to runtime environment

Published Mar 3, 2026 · Updated Mar 3, 2026 · Assigned by ibm

Vendor: IBM Product: DataStage on Cloud Pak for Data

Description

IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the wrapped command component.

Affected products

Vendor	Product	Affected	Fixed
IBM	DataStage on Cloud Pak for Data	5.1.2 – ≤ 5.3.0	—

References

https://www.ibm.com/support/pages/node/7262347 vendor-advisory patch