CVE-2026-6576

OVERVIEW CVE-2026-6576 is a command injection vulnerability identified in liangliangyy DjangoBlog versions up to 2.1.0.0, specifically within the CommandHandler function of the WeChat Bot Interface component (servermanager/api/commonapi.py). The vulnerability allows attackers to manipulate the Source argument to execute arbitrary commands on affected systems. SEVERITY The vulnerability carries a CVSS score of 6.3 (MEDIUM), reflecting a network-based attack vector with low complexity and no user interaction required. It affects confidentiality, integrity, and availability equally, though authentication is required to exploit the vulnerability. The FAUCET Risk Score of 44.0/100 indicates moderate concern, though the EPSS score of 0.0025 suggests relatively low prevalence in active threat landscapes compared to other CVEs. EXPLOITATION STATUS Public exploit code is available for this vulnerability, and the attack vector has been disclosed publicly. While the vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog, it appears on the Active Hot List, indicating ongoing attention from security researchers and potential threat actors. The vendor was contacted early in the disclosure process but has not responded or provided patches.