CVE-2024-28397
js2py allows remote code execution
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
- Record
CVE-2024-28397- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2024-2066
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
- Record
EUVD-2024-2066- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h95x-26f3-88hr
js2py allows remote code execution
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
- Record
GHSA-h95x-26f3-88hr- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
- Record
CVE-2024-28397- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-h95x-26f3-88hr
js2py allows remote code execution
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
- Record
GHSA-h95x-26f3-88hr- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVPYSEC-2026-1476
js2py allows remote code execution
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
- Record
PYSEC-2026-1476- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2024-28397
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
- Record
UBUNTU-CVE-2024-28397- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVMGASA-2024-0256 No score
Updated python-js2py packages fix security vulnerability
CVE-2024-28397: Fixed a potential sandbox escape via untrusted JavaScript code
- Record
MGASA-2024-0256- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14086-1 No score
python310-Js2Py-0.74-3.1 on GA media
These are all security issues fixed in the python310-Js2Py-0.74-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14086-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11322-1 No score
python313-Js2Py-0.74-6.1 on GA media
These are all security issues fixed in the python313-Js2Py-0.74-6.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11322-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2272-1 No score
Security update for python-Js2Py
This update for python-Js2Py fixes the following issues:
- CVE-2024-28397: Fixed a potential sandbox escape via untrusted JavaScript code (bsc#1226660).
- Record
SUSE-SU-2024:2272-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
js2pyPyPI |
through 0.74 | None known |
js2pyPyPI |
through 0.74, plus listed versions 0.10.20.210.220.23 Show 42 moreShow less0.250.260.270.280.290.300.310.320.330.350.360.370.390.400.410.420.430.440.470.480.490.500.510.520.530.540.550.560.570.580.590.600.610.620.630.660.670.680.690.700.710.72 |
None known |
python-js2pyMageia:9 |
before 0.70-3.1.mga9 | 0.70-3.1.mga9 |
python-Js2PyopenSUSE:Leap 15.6 |
before 0.74-150400.9.6.1 | 0.74-150400.9.6.1 |
python-cloudscraperUbuntu:24.04:LTS |
All versions, plus listed versions 1.2.69-11.2.69-21.2.71~git20230426.cbb3c0ea-1 |
None known |
python-cloudscraperUbuntu:25.10 |
All versions, plus listed versions 1.2.71~git20230426.cbb3c0ea-1 |
None known |
python-cloudscraperUbuntu:26.10 |
All versions, plus listed versions 1.2.71~git20230426.cbb3c0ea-1build1 |
None known |
python-cloudscraperUbuntu:26.04:LTS |
All versions, plus listed versions 1.2.71~git20230426.cbb3c0ea-11.2.71~git20230426.cbb3c0ea-1build1 |
None known |
python-Js2PyopenSUSE:Tumbleweed |
before 0.74-3.1 | 0.74-3.1 |
python-Js2PyopenSUSE:Tumbleweed |
before 0.74-6.1 | 0.74-6.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Js2Py 0.74 - RCE | 2026-04-30 |
| Metasploit | Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397) | 2024-10-28 |
| Nuclei | pyload-ng js2py - Remote Code Execution | |
| PoC in GitHub | 0xDTC/js2py-Sandbox-Escape-CVE-2024-28397-RCE | 2025-09-15 |
| PoC in GitHub | 3z-p0wn/CVE-2024-28397-exploit | 2026-01-11 |
| PoC in GitHub | CYBER-WARRIOR-SEC/CVE-2024-28397-js2py-Sandbox-Escape | 2024-06-21 |
| PoC in GitHub | D3ltaFormation/CVE-2024-28397-Js2Py-RCE | 2025-09-17 |
| PoC in GitHub | GhostOverflow/CVE-2024-28397-command-execution-poc | 2025-08-17 |
| PoC in GitHub | L1337Xi/CVE-2024-28397-Exploit-Automation | 2025-12-06 |
| PoC in GitHub | Marven11/CVE-2024-28397-js2py-Sandbox-Escape | 2024-06-19 |
Show 9 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Naved124/CVE-2024-28397-js2py-Sandbox-Escape | 2025-08-28 |
| PoC in GitHub | RianJuniorSf/exploit-js2py | 2025-08-18 |
| PoC in GitHub | Udayveer17/Remote-Code-Execution-CVE-2024-28397-pyload-ng-js2py- | 2025-09-06 |
| PoC in GitHub | harutomo-jp/CVE-2024-28397-RCE | 2025-08-18 |
| PoC in GitHub | naclapor/CVE-2024-28397 | 2025-09-09 |
| PoC in GitHub | somisec/CVE-2024-28397-Reverse-Shell | 2025-10-12 |
| PoC in GitHub | vitaciminIPI/CVE-2024-28397-RCE | 2025-09-17 |
| PoC in GitHub | xeloxa/CVE-2024-28397-Js2Py-RCE-Exploit | 2026-02-03 |
| PoC in GitHub | y0naldez/CVE-2024-28397-Js2Py-RCE | 2026-05-12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-28397 is a medium vulnerability (CVSS 5.3) in Js2py Disable Pyimport, published June 20, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.55%, the 91st percentile. Fixed in python-js2py 0.70-3.1.mga9.
References
github.com/Marven11
nvd.nist.gov/vuln/detail/CVE-2024-28397
Show 9 moreShow less
advisories.mageia.org/MGASA-2024-0256.html
bugs.mageia.org/show_bug.cgi?id=33354
lwn.net/Articles/980387
pypi.org/project/js2py
suse.com/support/update/announcement/2024/suse-su-20242272-1
bugzilla.suse.com/1226660
ubuntu.com/security/CVE-2024-28397
cve.org/CVERecord?id=CVE-2024-28397