What is the CVSS score of CVE-2026-42168?

CVE-2026-42168 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.6%.

Which versions of django-pyas2 are affected by CVE-2026-42168?

django-pyas2 versions through 1.2.3 contain an authenticated OS command injection vulnerability (CVE-2026-42168, CVSS 9.1) for which publicly available exploit code exists.

How to fix or mitigate CVE-2026-42168?

Within 24 hours, inventory all systems running django-pyas2 and audit admin user access privileges and recent activity logs for suspicious Partner model changes. Within 7 days, restrict AS2 admin console access to the minimum required personnel, enforce multi-factor authentication on all admin accounts, implement input validation and command sanitization on Partner model fields (cmd_receive, cmd_send), and segment AS2 processing systems from critical infrastructure. Within 30 days, contact the django-pyas2 maintainers to request a patch timeline, evaluate alternative EDI/AS2 solutions, and develop a migration plan if remediation is not available within 60 days.

django-pyas2 CVE-2026-42168

CRITICAL

OS Command Injection (CWE-78)

2026-07-17 mitre

Python Command Injection N A

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.2 HIGH

Requires admin write access to the Partner config, so PR:H; network-reachable admin UI with low complexity, and shell command execution yields full C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 20, 2026 - 19:26 vuln.today

Analysis Generated

Jul 20, 2026 - 19:26 vuln.today

CVSS changed

Jul 20, 2026 - 19:22 NVD

9.1 (CRITICAL)

CVE Published

Jul 17, 2026 - 00:00 cve.org

CRITICAL 9.1

CVE Published

Jul 17, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields are passed directly to os.system() in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when an AS2 message is received or sent.

AnalysisAI

OS command injection in django-pyas2 through version 1.2.3 lets an authenticated admin plant shell commands in the Partner model's cmd_receive and cmd_send fields, which pyas2/utils.py hands directly to os.system() when an AS2 message is processed. The submitted CVSS vector rates this 9.1 (network, unauthenticated), but the description explicitly requires an authenticated admin user, so real-world exploitability is meaningfully narrower than the headline score. EPSS is low (0.64%, 47th percentile), there is no CISA KEV listing, and a third-party vulnerability-research repository is referenced that appears to document the flaw.

Technical ContextAI

django-pyas2 is a Django web application implementing the AS2 (Applicability Statement 2) secure file-transfer protocol used for B2B EDI exchange. Partner objects in the app expose cmd_receive and cmd_send hook fields intended to run post-processing commands on inbound/outbound payloads; the code path in pyas2/utils.py interpolates these operator-supplied strings into os.system() with no escaping or allow-listing. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) issue: because os.system() invokes a shell, metacharacters such as ;, |, $(), and backticks in the stored field are interpreted by /bin/sh, converting a configuration field into arbitrary command execution. The CPE data supplied is a placeholder (cpe:2.3:a:n/a:n/a:*) and does not identify the product, so affected-version scoping rests on the CVE description rather than NVD CPE.

RemediationAI

No vendor-released patch is identified at time of analysis - the referenced v1.2.3 release notes only cover a pyas2lib bump to 1.4.3, field-length and documentation changes, and contain no fix for this command-injection path, and 1.2.3 is the affected version. As compensating controls: restrict and network-segment the Django admin interface (bind it behind VPN/allow-listed IPs and require strong MFA) so the required admin credential is hard to reach, since exploitation depends on write access to the Partner model; treat all Partner cmd_receive/cmd_send values as untrusted and audit existing Partner records for injected shell metacharacters (;, |, &&, $(), backticks); and run the application under a least-privilege OS account inside a container so that any triggered command executes with minimal blast radius rather than as root. If the post-receive/post-send command hooks are not needed, remove or blank these fields to eliminate the sink entirely, accepting the trade-off of losing custom payload post-processing. Monitor the vendor repository at https://github.com/abhishek-ram/django-pyas2 for a patched release and upgrade as soon as one that replaces os.system() with a sanitized subprocess call (no shell) is published.