PT-2026-60850 · Undefined · Undefined

CVE-2026-42168 · Publicado 2026-07-17 · Atualizado 2026-07-17

NVD

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd receive and cmd send fields on the Partner model. These fields are passed directly to os.system() in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when an AS2 message is received or sent.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-42168

Produtos afetados

Undefined

Referências · 4

• 🔥 https://github.com/m4ty-m/vulnerability-research/tree/main/CVE-2026-42168 · Exploit
• https://github.com/abhishek-ram/django-pyas2 · Nota
• https://github.com/abhishek-ram/django-pyas2/releases/tag/v1.2.3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-42168 · Nota de Segurança