EUVD-2026-31645
GHSA-rpvv-2fvv-23x5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in DTStack Taier 1.4.0. This affects the function Runtime.exec of the component REST API. The manipulation of the argument sqlText leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
OS command injection in DTStack Taier 1.4.0 permits remote low-privileged authenticated attackers to execute arbitrary operating system commands by injecting shell metacharacters into the sqlText parameter, which is passed unsanitized to Java's Runtime.exec() within the REST API. A public proof-of-concept exploit has been disclosed on GitHub. No vendor patch exists - the vendor did not respond to responsible disclosure - leaving all Taier 1.4.0 deployments without an official remediation path at time of analysis.
Technical ContextAI
DTStack Taier is a distributed task scheduling platform. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): user-supplied input from the sqlText REST API argument is passed without sanitization to Java's Runtime.exec() method, which invokes OS-level process execution. Because Runtime.exec() can interpret shell metacharacters (semicolons, pipes, ampersands) when input is naively constructed into a command string, an attacker can append arbitrary commands. CPE cpe:2.3:a:dtstack:taier:*:*:*:*:*:*:*:* identifies the affected application; EUVD (EUVD-2026-31645) narrows the confirmed affected release to version 1.4.0. The wildcard CPE version field raises the question of whether adjacent versions are also vulnerable, but no vendor guidance exists to clarify scope.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor did not respond to responsible disclosure, and no official fix version has been published. Compensating controls should be applied in the interim. First, restrict access to the Taier REST API to trusted, authenticated users over network controls (firewall rules, VPN, API gateway), reducing the exposure surface for the low-privileged authentication requirement. Second, implement input validation at the WAF or reverse-proxy layer to reject or sanitize shell metacharacters (semicolons, pipes, backticks, ampersands) in the sqlText parameter; note this may break legitimate SQL text payloads if not carefully tuned. Third, run the Taier application process under a dedicated, minimally privileged OS account with no shell access where possible, to limit what injected commands can accomplish - this aligns with the low CVSS impact scores and may already be partially in place. Fourth, enable process-level auditing (auditd or equivalent) to detect anomalous child processes spawned by the Taier JVM. Monitor the VulDB entry at https://vuldb.com/vuln/365418 and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-9437 for any future vendor patch release.
An insecure permissions in /Taier/API/tenant/listTenant interface in DTStack Taier 1.3.0 allows attackers to view sensit
Path traversal in DTStack Taier 1.4.0's Chunk-Check Endpoint exposes the server's filesystem to remote unauthenticated a
Path traversal in DTStack Taier 1.4.0 allows an authenticated administrative user to supply a crafted clusterName contai
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today