CVE-2026-42168
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields are passed directly to os.system() in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when an AS2 message is received or sent.
Risk Assessment
An authenticated admin can execute arbitrary system commands on the server, leading to full system compromise and potential takeover of the application.
Recommendation
Upgrade django-pyas2 to a version above 1.2.3 that contains the fix, and restrict admin privileges.
Original NVD description (English source)
django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields are passed directly to os.system() in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when an AS2 message is received or sent.