{"id":"CVE-2024-28397","aliases":["GHSA-h95x-26f3-88hr","PYSEC-2026-1476"],"title":"js2py allows remote code execution","summary":"js2py allows remote code execution","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendor":"js2py","product":"js2py","ecosystem":"pip","affected":["js2py <= 0.74"],"published":"2024-06-20","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:15.483446977Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-h95x-26f3-88hr","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28397"},{"url":"https://github.com/PiotrDabkowski/Js2Py/pull/323"},{"url":"https://github.com/Marven11"},{"url":"https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape"},{"url":"https://github.com/PiotrDabkowski/Js2Py"}],"tags":["osv","pip","exploit-available"],"epss":0.04548,"epssPercentile":0.91162,"exploits":{"exploitdb":true,"github":16,"githubRepos":["https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape","https://github.com/CYBER-WARRIOR-SEC/CVE-2024-28397-js2py-Sandbox-Escape","https://github.com/GhostOverflow/CVE-2024-28397-command-execution-poc"],"metasploit":["exploit/linux/http/pyload_js2py_cve_2024_39205"],"nuclei":["CVE-2024-28397"],"checkedAt":"2026-09-21T15:26:25.432Z"},"exploitAvailable":true,"ingestedAt":"2026-07-08T18:25:50.030Z","slug":"CVE-2024-28397","body":"## Overview\n\nAn issue in the component `js2py.disable_pyimport()` of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.\n\n## Affected packages\n\n- `js2py <= 0.74`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"midnight","depthScore":61,"depthScoreParts":{"impact":48.4,"likelihood":0.9,"exploitation":12,"ransomware":0},"changes":[]}