CVE-2024-28397 json
js2py allows remote code execution
published 2024-06-20 2 y ago modified 2026-09-10 1 mo ago also GHSA-h95x-26f3-88hr , PYSEC-2026-1476 , EUVD-2024-2066
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.5%
- EPSS 4.5% chance of exploitation in 30 days, percentile 91%
- public exploits
- 2
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
Patch / fix
- python-Js2Py openSUSE Leap 15.6 0.74-150400.9.6.1
suse advisories SUSE-SU-2024:2272-1
- python-Js2Py openSUSE Tumbleweed 0.74-6.1
- python-Js2Py openSUSE Tumbleweed 0.74-3.1
opensuse advisories openSUSE-SU-2026:11322-1openSUSE-SU-2024:14086-1
- github.com/PiotrDabkowski/Js2Py#323 pull request
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-28397 updated cvss 8.8
js2py: command injection via a crafted API call
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- Published
- First public exploit (Metasploit exploit/linux/http/pyload_js2py_cve_2024_39205)
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
4.55% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/http/pyload_js2py_cve_2024_39205 Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397) metasploit exploit, excellent rank, 2024-10-28
- EDB-52532 Js2Py 0.74 - RCE webapps, 2026-04-30
- Nuclei template pyload-ng js2py - Remote Code Execution nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| OSV | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | js2py | <=0.74 |
no fix listed |
Affected products
- js2py js2py_disable_pyimport
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/PiotrDabkowski/Js2Py/pull/323
web
-
github.com
/Marven11
web
-
github.com
/Marven11/CVE-2024-28397-js2py-Sandbox-Escape
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-28397
advisory
-
github.com
/PiotrDabkowski/Js2Py
package
-
pypi.org
/project/js2py
package
-
github.com
/advisories/GHSA-h95x-26f3-88hr
advisory
Sources
- CVE List CVE-2024-28397
- GitHub Advisory GHSA-h95x-26f3-88hr
- NVD CVE-2024-28397
- OSV PYSEC-2026-1476
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.