high8.8Public exploit code
CVE-2024-28397
js2py allows remote code execution
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Js2Py 0.74 - RCE2026-04-30 · webapps · multiple
Impact
An issue in the component `js2py.disable_pyimport()` of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | js2py | <= 0.74 | none recorded |
Affected products
| Product | Affected versions |
|---|---|
| Js2py | before 0.74 |
Versions were read from the advisory text. No structured product data has been published for this record yet.