# CVE-2024-28397

An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

- Page: https://www.vulneraibility.com/cve/CVE-2024-28397
- CVSS: 5.3
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 4.81% (percentile 92.1)
- Public exploit code: 1 on Exploit-DB · 1 Metasploit module · 16 GitHub proofs of concept · 1 Nuclei template (first 2024-06-19)
- CISA SSVC: exploitation poc, automatable no, technical impact partial (assessed 2024-06-26)
- Weakness: CWE-94
- Published: 2024-06-20

## References

- [other] https://github.com/Marven11
- [other] https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.