CVE-2026-42168: Django-PyAS2 RCE Vulnerability

CVE-2026-42168 Overview

CVE-2026-42168 is an operating system command injection vulnerability in django-pyas2 through version 1.2.3. The flaw resides in the cmd_receive and cmd_send fields of the Partner model. These fields flow directly into os.system() within pyas2/utils.py without input sanitization. An authenticated administrator can execute arbitrary shell commands whenever an AS2 message is sent or received. The weakness is classified as [CWE-78] Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Authenticated administrators can achieve arbitrary command execution on the host running django-pyas2, leading to full server compromise triggered by routine AS2 message flow.

Affected Products

django-pyas2 versions up through 1.2.3
Django applications embedding the pyas2 module for AS2 messaging
Deployments exposing the Partner administration interface to authenticated admins

Discovery Timeline

2026-07-17 - CVE-2026-42168 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-42168

Vulnerability Analysis

The django-pyas2 package implements AS2 (Applicability Statement 2) messaging for Django. AS2 is a specification for secure business-to-business data exchange over HTTP. Partners are configured through the Django admin interface, where each Partner record includes optional cmd_receive and cmd_send fields intended to run helper commands during message processing.

During AS2 message handling, the pyas2/utils.py module passes the stored command string directly to Python's os.system(). No escaping, allowlisting, or argument parsing is performed. Any shell metacharacter such as ;, &&, |, or backticks is interpreted by the underlying shell.

Exploitation requires an authenticated administrator account to write the malicious command into a Partner record. Execution occurs asynchronously when an AS2 message is subsequently sent to or received from that partner, running under the Django worker process identity.

Root Cause

The root cause is the use of os.system() on attacker-controlled input persisted through the Django admin. os.system() invokes /bin/sh -c on the supplied string, giving the shell full authority to parse metacharacters. The Partner model treats cmd_receive and cmd_send as trusted operational hooks rather than sensitive command templates that require safe argument passing through subprocess.run() with shell=False.

Attack Vector

An attacker who compromises or acquires an admin session sets a payload such as a reverse shell command in the cmd_send or cmd_receive field of a Partner. When django-pyas2 processes the next AS2 message for that Partner, the shell interprets the payload and executes it on the server. Because AS2 messaging is triggered by external partners over the network, the timing of execution can be forced by initiating a message exchange.

See the GitHub Vulnerability Research repository for CVE-2026-42168 for proof-of-concept material and the django-pyas2 project repository for the affected source.

Detection Methods for CVE-2026-42168

Indicators of Compromise

Partner records containing shell metacharacters such as ;, |, &&, $(, or backticks in the cmd_receive or cmd_send fields
Child processes of the Django/WSGI/Celery worker spawning /bin/sh, bash, curl, wget, nc, or python -c around AS2 message events
Outbound network connections from the django-pyas2 host to unfamiliar hosts immediately after AS2 traffic
Unexpected files written under the Django project directory or /tmp correlated with AS2 processing timestamps

Detection Strategies

Audit the pyas2_partner database table for command strings that do not match a documented allowlist of operational commands
Alert on process creation events where the parent is a Python/Django worker and the child is a shell interpreter
Correlate AS2 message log entries in django-pyas2 with process execution telemetry from the host
Review Django admin audit logs for edits to Partner objects, especially updates to cmd_receive or cmd_send

Monitoring Recommendations

Enable Django admin action logging and forward it to a centralized log store for retention and search
Monitor egress traffic from application servers hosting django-pyas2 for anomalous destinations and protocols
Track file integrity of pyas2/utils.py and the Django settings module to identify tampering

How to Mitigate CVE-2026-42168

Immediate Actions Required

Inventory all deployments of django-pyas2 and identify versions at or below 1.2.3
Clear the cmd_receive and cmd_send fields on every Partner record unless they are strictly required
Restrict Django admin access to trusted operators and enforce multi-factor authentication for admin logins
Review historical Partner edits and worker process logs for prior exploitation attempts

Patch Information

At the time of publication, no fixed release beyond version 1.2.3 is referenced in the CVE data. Consult the django-pyas2 releases page for the latest fix status and apply any subsequent security release as soon as it becomes available.

Workarounds

Remove or blank the cmd_receive and cmd_send values in the Partner administration UI, and enforce this with a database constraint or Django model validator
Patch pyas2/utils.py locally to invoke commands via subprocess.run() with shell=False and a fixed argument list, rejecting any user-supplied string
Place the Django admin interface behind a VPN or IP allowlist to reduce exposure of the vulnerable configuration surface
Run the Django worker under a least-privileged system account with restricted shell access and outbound network policy

bash

# Configuration example: neutralize the vulnerable fields in the database
python manage.py shell -c "from pyas2.models import Partner; Partner.objects.update(cmd_receive='', cmd_send='')"