A command injection vulnerability is present in the CommandHandler function of the WeChat Bot interface within the Liangliangyy DjangoBlog project. By manipulating the Source argument, an attacker can inject arbitrary operating‑system commands that are executed by the host server. This flaw permits remote code execution, compromising the confidentiality, integrity, and availability of the affected system.

All versions of Liangliangyy DjangoBlog up to and including 2.1.0.0 are affected. The flaw resides in the servermanager/api/commonapi.py module of the WeChat Bot interface, so any deployment that exposes this API is vulnerable. The vendor did not release a patch for affected versions.

The CVSS base score of 5.3 indicates moderate severity, while the EPSS value is not available and the vulnerability is not listed in the CISA KEV catalog. Because the flaw has been publicly disclosed and the exploit is readily available, the risk to exposed systems may be higher than the CVSS score alone suggests. Attackers can send crafted requests to the Source parameter over the network and trigger arbitrary command execution, potentially gaining full control of the server.