Command Injection

Overview django-pyas2 is an AS2 file transfer Server built on Python and Django. Affected versions of this package are vulnerable to Command Injection via the cmdreceive and cmdsend fields in the Partner model, which are passed directly to the os.system function without sanitization. An attacker...

CVE-2026-42168

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmdreceive and cmdsend fields on the Partner model. These fields are passed directly to os.system in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when ...

PT-2026-60850

Name of the Vulnerable Software and Affected Versions django-pyas2 versions prior to 1.2.4 Description An OS command injection flaw exists where the cmd receive and cmd send fields on the Partner model are passed directly to the os.system function in pyas2/utils.py without proper sanitization. Th...

CVE-2026-42168: Improper Neutralization of Special Elements used in an OS Command

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmdreceive and cmdsend fields on the Partner model. These fields are passed directly to os.system in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when ...