CVE-2007-0404
Django 0.95 - OS Command Injection via Unquoted .po/.mo File Arguments
Title source: llmDescription
bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.
References (4)
Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/31627
Patch, Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/23826
Various Sources x_refsource_confirm
http://code.djangoproject.com/changeset/3592
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/22134
Scores
EPSS
0.0156
EPSS Percentile
72.6%
Details
Status
published
Products (2)
django_project/django
0.95
pypi/Django
0.95 - 1.0PyPI
Published
Jan 23, 2007
Tracked Since
Feb 18, 2026