Lucene search

GoogleOSV:GHSA-H95X-26F3-88HR

HistoryJun 20, 2024 - 6:34 p.m.

js2py allows remote code execution

2024-06-2018:34:08

Google

osv.dev

js2py

remote code execution

component

software

api call

7.9 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

CPENameOperatorVersion
js2pyeq0.58
js2pyeq0.57
js2pyeq0.55
js2pyeq0.36
js2pyeq0.43
js2pyeq0.44
js2pyeq0.32
js2pyeq0.52
js2pyeq0.35
js2pyeq0.74

Name	Operator	Version
js2py	eq	0.58
js2py	eq	0.57
js2py	eq	0.55
js2py	eq	0.36
js2py	eq	0.43
js2py	eq	0.44
js2py	eq	0.32
js2py	eq	0.52
js2py	eq	0.35
js2py	eq	0.74

Rows per page:

1-10 of 481

References

github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape

github.com/PiotrDabkowski/Js2Py

github.com/PiotrDabkowski/Js2Py/pull/323

nvd.nist.gov/vuln/detail/CVE-2024-28397