Lucene search

Ubuntu.comUB:CVE-2024-28397

HistoryJun 21, 2024 - 12:00 a.m.

CVE-2024-28397

2024-06-2100:00:00

ubuntu.com

js2py interpreter

python-cloudscraper

arbitrary code execution

7.8 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

An issue in the component js2py.disable_pyimport() of js2py up to v0.74
allows attackers to execute arbitrary code via a crafted API call.

Author	Note
rodrigo-zaiden	python-cloudscraper includes js2py interpreter

OSVersionArchitecturePackageVersionFilename
ubuntu24.04noarchpython-cloudscraper< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	24.04	noarch	python-cloudscraper	< any	UNKNOWN

References

github.com/Marven11

github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape

launchpad.net/bugs/cve/CVE-2024-28397

nvd.nist.gov/vuln/detail/CVE-2024-28397

security-tracker.debian.org/tracker/CVE-2024-28397

www.cve.org/CVERecord?id=CVE-2024-28397