CyberRota Analysis
AI-GeneratedDjango-pyas2 versions up to 1.2.3 are vulnerable to OS command injection due to unsanitized input in the cmd_receive and cmd_send fields of the Partner model, which are directly passed to os.system(). This critical vulnerability allows authenticated admin users to execute arbitrary commands on the server during AS2 message processing. Organizations using this library should prioritize immediate remediation to prevent potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields are passed directly to os.system() in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when an AS2 message is received or sent.