The django-pyas2 package up to version 1.2.3 is vulnerable to OS command injection due to unsanitized use of the cmd_receive and cmd_send fields in the Partner model. These fields are passed directly to os.system() in the pyas2/utils.py module, enabling an authenticated administrator to execute arbitrary operating system commands when AS2 messages are received or sent. This vulnerability arises from improper input validation and unsafe command execution practices within the application code.

An authenticated admin user can exploit this vulnerability to execute arbitrary OS commands on the server hosting django-pyas2. This could lead to full system compromise, data theft, or disruption of service depending on the commands executed. The vulnerability requires administrative authentication, limiting exposure to trusted users with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and avoid using vulnerable versions in production environments. Monitor vendor channels for updates or official patches addressing this issue.