The django-pyas2 package through version 1.2.3 is vulnerable to OS command injection due to unsanitized use of the cmd_receive and cmd_send fields on the Partner model. These fields are directly passed to the os.system() function in pyas2/utils.py without input validation or sanitization. An authenticated admin user can exploit this flaw to execute arbitrary operating system commands on the server when an AS2 message is received or sent. This vulnerability is tracked as CVE-2026-42168 and is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Successful exploitation allows an authenticated admin user to execute arbitrary OS commands on the server, potentially leading to full system compromise or unauthorized actions. The vulnerability impacts confidentiality and integrity but does not directly affect availability. The CVSS score of 9.1 reflects a critical impact with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and avoid using affected versions in production environments. Monitor for vendor updates or patches addressing this vulnerability.