Quick answers
- Is CVE-2026-9437 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-9437 being exploited in the wild.
- How severe is CVE-2026-9437?
- Medium severity, with a CVSS score of 6.3, published 25 May 2026.
- Which products and versions are affected?
- DTStack Taier 1.4.0.
- Is there a fix for CVE-2026-9437?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-9437 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-9437?
- Check whether you run DTStack Taier at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A command injection vulnerability exists in DTStack Taier 1.4.0 within the REST API component. The application accepts user-supplied SQL text via the 'sqlText' parameter, stores it in a MySQL database, and subsequently passes it to the Java 'Runtime.exec()' function using a 'sh -c' prefix without proper sanitization or validation. An authenticated attacker with task or job creation permissions can inject shell metacharacters (such as semicolons or backticks) into the SQL text to achieve remote code execution (RCE). While the vendor was notified, no official patch has been confirmed at the time of disclosure; remediation should involve migrating to ProcessBuilder with explicit argument lists and implementing strict input validation.
Affected products
- DTStack Taier 1.4.0
Timeline
- 2026-05-25: disclosed: Public disclosure of the exploit details.
- 2026-05-25: advisory: CVE-2026-9437 published.