CVE-2026-42168
Summary
| CVE | CVE-2026-42168 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-17 20:17:16 UTC |
| Updated | 2026-07-17 20:17:16 UTC |
| Description | django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields are passed directly to os.system() in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when an AS2 message is received or sent. |
Risk And Classification
Problem Types: n/a
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/abhishek-ram/django-pyas2/releases/tag/v1.2.3 | [email protected] | github.com | |
| github.com/abhishek-ram/django-pyas2 | [email protected] | github.com | |
| github.com/m4ty-m/vulnerability-research/tree/main/CVE-2026-42168 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.