---
id: CVE-2024-28397
aliases:
  - GHSA-h95x-26f3-88hr
  - PYSEC-2026-1476
title: js2py allows remote code execution
summary: js2py allows remote code execution
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
vendor: js2py
product: js2py
ecosystem: pip
affected:
  - js2py <= 0.74
published: '2024-06-20'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:15.483446977Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-h95x-26f3-88hr'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-28397'
  - url: 'https://github.com/PiotrDabkowski/Js2Py/pull/323'
  - url: 'https://github.com/Marven11'
  - url: 'https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape'
  - url: 'https://github.com/PiotrDabkowski/Js2Py'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.04548
epssPercentile: 0.91158
exploits:
  exploitdb: true
  github: 16
  githubRepos:
    - 'https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape'
    - 'https://github.com/CYBER-WARRIOR-SEC/CVE-2024-28397-js2py-Sandbox-Escape'
    - 'https://github.com/GhostOverflow/CVE-2024-28397-command-execution-poc'
  metasploit:
    - exploit/linux/http/pyload_js2py_cve_2024_39205
  nuclei:
    - CVE-2024-28397
  checkedAt: '2026-09-23T07:13:29.180Z'
exploitAvailable: true
ingestedAt: '2026-07-08T18:25:50.030Z'
---

## Overview

An issue in the component `js2py.disable_pyimport()` of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

## Affected packages

- `js2py <= 0.74`

## Remediation

Refer to the advisory for the patched release.