OS Command Injection in Django-pyas2 Affects Partner Model
CVE-2026-42168

9.1CRITICAL

Key Information:

Vendor

Django

Status
django-pyas2
Vendor
CVE Published:
17 July 2026

What is CVE-2026-42168?

The django-pyas2 library, specifically version 1.2.3, contains a significant vulnerability in its Partner model. The cmd_receive and cmd_send fields accept input without proper sanitization and directly pass it to the os.system() function. This flaw allows authenticated admin users to execute arbitrary commands on the server whenever an AS2 message is processed. An attack leveraging this vulnerability could compromise the integrity and confidentiality of the server.

References

https://github.com/abhishek-ram/django-pyas2
https://github.com/abhishek-ram/django-pyas2/releases/tag...
https://github.com/m4ty-m/vulnerability-research/tree/mai...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.