Lucene search

K
osvGoogleOSV:GHSA-H95X-26F3-88HR
HistoryJun 20, 2024 - 6:34 p.m.

js2py allows remote code execution

2024-06-2018:34:08
Google
osv.dev
16
js2py
remote code execution
component
software
api call

CVSS3

5.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

22.7%

An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

CVSS3

5.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

22.7%