CVE-2026-42168
A vulnerability in the django-pyas2 library allows for OS command injection through specific fields in the Partner model. This occurs because input from these fields is passed directly to system commands without being cleaned or checked first.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users running django-pyas2 versions 1.2.3 and earlier.
Real-world impact
An authenticated administrator could execute arbitrary commands on the server, potentially taking control of the system when processing AS2 messages.
Why this severity
The critical score is due to the ability to execute commands remotely over a network without requiring user interaction, which can lead to a total compromise of data confidentiality and integrity.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 17, 2026 · 16d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 10d agoAdvisory updatedThe NVD record was last revised.