CVE-2007-0404: Django Project Django

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.

Affected products

• Django Project Django: version 0.95 only

Published 2007-01-23. Last modified 2026-06-16.