Option(s) to prevent uncontrolled execution of data stack elements as commands.

Just to be clearer:

1 - Unilaterally flushing the stack would be far less desirable than (optionally) leaving the stack intact so it can be used as input to the next command program.

2 - Implementing the requirement, in some form, under ISPF first, and then something similar under TSO later, is more desirable, from a security and usability perspective, than delaying the implementation to get everything. Almost all users spend almost all of their time inside ISPF. (Many newer users refer to ISPF as TSO and they get confused when I make the distinction.) Adding an additional command stacking character (or 2) to ISPF is, IMHO, far less drastic of a change in terms of work effort and incompatibility. Defaulting the non-stack-flushing command stacking character to a vertical bar ( | ) would minimize the end-user confusion, as the operator is well-known on other platforms.

P.S. ISPEXEC CMD(...) BARRIER is not a solution. BARRIER discards the stack data, preventing data from being passed from one program to the next.

This suggestion has merit and will be considered for incorporation into a future release,but there are many considerations that need to be taken into account prior to implementation. This request applies to all REXX environments, not just ISPF and TSO, so ISPF specific updates would not apply. It would most likely not be the default setting (at least initially), so that current processes dependent on the current behavior would not be impacted. A switch would most likely be defined either in TSO or the security product to activate the flushing of the stack upon EXEC completion. There would also need to be a mechanism to allow for specific EXECs to have stack execution of commands after completion.