---
id: CVE-2007-0404
aliases:
  - GHSA-qc99-g3wm-hgxr
  - PYSEC-2026-630
title: Django Arbitrary Code Execution
summary: Django Arbitrary Code Execution
severity: high
vendor: django
product: django
ecosystem: pip
affected:
  - 'django >= 0.95, < 1.0'
patched:
  - django 1.0
published: '2022-05-01'
updated: '2026-07-06'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-qc99-g3wm-hgxr'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2007-0404'
  - url: 'https://github.com/django/django/commit/518d406e53'
  - url: >-
      https://github.com/django/django/commit/a132d411c6986418ee6c0edc331080aa792fee6e
  - url: 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=407519'
  - url: 'https://exchange.xforce.ibmcloud.com/vulnerabilities/31627'
  - url: 'https://github.com/django/django'
  - url: 'http://code.djangoproject.com/changeset/3592'
tags:
  - osv
  - pip
epss: 0.01653
epssPercentile: 0.75118
ingestedAt: '2026-07-08T18:25:52.399Z'
---

## Overview

`bin/compile-messages.py` in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.

## Affected packages

- `django >= 0.95, < 1.0`

## Remediation

Upgrade to a patched release:

- `django 1.0`