# CVE-2026-9437: DTStack Taier OS command injection in REST API

Source: https://junglewise.ai/threats/cve-2026-9437-dtstack-taier-os-command-injection-in-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-9437 · Severity: medium · CVSS 6.3 · Published 2026-05-25

DTStack Taier, a platform for big data development, contains a security flaw that allows authenticated users to execute unauthorized operating system commands. By submitting specially crafted SQL text through the application's programming interface (API), an attacker can gain control over the underlying server. This could lead to the theft of sensitive data, disruption of data processing operations, or full system compromise.

Technologies: [DTStack Taier](https://junglewise.ai/threats/technologies/taier). Vendors: [DTStack](https://junglewise.ai/threats/vendors/dtstack).

## Quick answers

**Is CVE-2026-9437 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9437 being exploited in the wild.

**How severe is CVE-2026-9437?** Medium severity, with a CVSS score of 6.3, published 25 May 2026.

**Which products and versions are affected?** DTStack Taier 1.4.0.

**Is there a fix for CVE-2026-9437?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9437 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9437?** Check whether you run DTStack Taier at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in DTStack Taier 1.4.0 within the REST API component. The application accepts user-supplied SQL text via the 'sqlText' parameter, stores it in a MySQL database, and subsequently passes it to the Java 'Runtime.exec()' function using a 'sh -c' prefix without proper sanitization or validation. An authenticated attacker with task or job creation permissions can inject shell metacharacters (such as semicolons or backticks) into the SQL text to achieve remote code execution (RCE). While the vendor was notified, no official patch has been confirmed at the time of disclosure; remediation should involve migrating to ProcessBuilder with explicit argument lists and implementing strict input validation.

## Affected products

- DTStack Taier 1.4.0

## Timeline

- 2026-05-25: disclosed: Public disclosure of the exploit details.
- 2026-05-25: advisory: CVE-2026-9437 published.

## References

- [https://github.com/fakebug111/my_public_bug/blob/main/issus02.md](https://github.com/fakebug111/my_public_bug/blob/main/issus02.md)
- [https://vuldb.com/submit/813941](https://vuldb.com/submit/813941)
- [https://vuldb.com/vuln/365418](https://vuldb.com/vuln/365418)
- [https://vuldb.com/vuln/365418/cti](https://vuldb.com/vuln/365418/cti)

## Related threats

- [DTStack Taier path traversal in cluster creation](https://junglewise.ai/threats/cve-2026-19763-dtstack-taier-path-traversal-in-cluster-creation)
- [DTStack Taier path traversal in chunk upload endpoint](https://junglewise.ai/threats/cve-2026-19762-dtstack-taier-path-traversal-in-chunk-upload-endpoint)
- [DTStack Taier path traversal in file upload controller](https://junglewise.ai/threats/cve-2026-19761-dtstack-taier-path-traversal-in-file-upload-controller)
- [DTStack Taier authentication bypass in LoginInterceptor](https://junglewise.ai/threats/cve-2026-11618-dtstack-taier-authentication-bypass-in-logininterceptor)