CVE-2026-42168

Name of the Vulnerable Software and Affected Versions django-pyas2 versions prior to 1.2.4

Description An OS command injection flaw exists where the cmd receive and cmd send fields on the Partner model are passed directly to the os.system() function in pyas2/utils.py without proper sanitization. This allows an authenticated admin user to execute arbitrary commands on the server during the process of receiving or sending an AS2 message.

Recommendations Update django-pyas2 to a version newer than 1.2.3. As a temporary mitigation, avoid configuring the cmd receive and cmd send fields on the Partner model.