{"id":"CVE-2025-13688","aliases":["EUVD-2025-208261","GHSA-g55j-73w9-5pc7"],"status":"published","title":"DataStage on Cloud Pak for Data is vulnerable to arbitrary code injection due to runtime environment","description":"IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the wrapped command component.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00388,"percentile":0.33342,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-03-03T20:44:40Z","modified":"2026-06-17T08:34:35Z","products":[{"vendor":"ibm","product":"datastage on cloud pak for data"},{"vendor":"ibm","product":"datastage_on_cloud_pak_for_data"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7262347","tags":["vendor-advisory","patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13688"},{"url":"https://github.com/advisories/GHSA-g55j-73w9-5pc7"}],"sources":{"cve":[{"id":"CVE-2025-13688","title":"DataStage on Cloud Pak for Data is vulnerable to arbitrary code injection due to runtime environment","description":"IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the wrapped command component.","status":"published","published":"2026-03-03T20:44:40.905Z","modified":"2026-03-03T21:30:47.045Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:43.437394Z"}],"euvd":[{"id":"EUVD-2025-208261","description":"IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the wrapped command component.","status":"published","published":"2026-03-03T20:44:40Z","modified":"2026-03-03T21:30:47Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:48:11.637968Z"}],"ghsa":[{"id":"GHSA-g55j-73w9-5pc7","title":"IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to...","description":"IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the wrapped command component.","status":"published","published":"2026-03-03T21:31:16Z","modified":"2026-03-03T21:31:23Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:06:26.357639Z"}],"nvd":[{"id":"CVE-2025-13688","description":"IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input through the wrapped command component.","status":"published","published":"2026-03-03T21:15:56.287Z","modified":"2026-06-17T08:34:35.267Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:01.096037Z"}]}}