Description
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python-cloudscraper | No fix yet | — |
| Ubuntu 26.04 LTS | python-cloudscraper | No fix yet | — |
| Ubuntu 25.10 | python-cloudscraper | No fix yet | — |
| Ubuntu 24.04 LTS | python-cloudscraper | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Js2Py | 0.74-3.1 | openSUSE-SU-2026:11322-1, openSUSE-SU-2024:14086-1 |
| openSUSE Leap 15.6 | python-Js2Py | 0.74-150400.9.6.1 | SUSE-SU-2024:2272-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kubeflow-pipelines-visualization-server | 2.4.0-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397)
exploit/linux/http/pyload_js2py_cve_2024_39205
Exploit-DB 1
- Js2Py 0.74 - RCE EDB-52532 · webapps · Apr 30, 2026
GitHub 16 repositories · most starred shown
-
Marven11/CVE-2024-28397-js2py-Sandbox-Escape ★ 73 · Jun 19, 2024
CVE-2024-28397: js2py sandbox escape, bypass pyimport restriction.
-
naclapor/CVE-2024-28397 ★ 12 · Sep 9, 2025
This repository contains a python exploit code for CVE-2024-28397 intended for use on the "CodePartTwo" machine on Hack The Box (HTB).
-
GhostOverflow/CVE-2024-28397-command-execution-poc ★ 5 · Aug 17, 2025
This vulnerability arises from incomplete sandboxing in js2py, where crafted JavaScript can traverse Python’s internal object model and access dangerous classes like subprocess.Popen, leading to arbi…
-
xeloxa/CVE-2024-28397-Js2Py-RCE-Exploit ★ 2 · Feb 3, 2026
Professional exploit for CVE-2024-28397: Js2Py Sandbox Escape leading to Remote Code Execution (RCE). Includes modular payload generation.
-
L1337Xi/CVE-2024-28397-Exploit-Automation ★ 2 · Dec 6, 2025
A Python automation script for exploiting the **js2py Sandbox Escape** vulnerability (CVE-2024-28397). This tool automates the payload generation and delivery process to achieve Remote Code Execution…
-
somisec/CVE-2024-28397-Reverse-Shell ★ 1 · Oct 12, 2025
Reverse shell for CVE-2024-28397.
-
Naved124/CVE-2024-28397-js2py-Sandbox-Escape ★ 1 · Aug 28, 2025
-
RianJuniorSf/exploit-js2py ★ 1 · Aug 18, 2025
The CVE-2024-28397 vulnerability affects versions of js2py up to v0.74, a Python library that allows JavaScript code to be executed within the Python interpreter.
-
harutomo-jp/CVE-2024-28397-RCE ★ 1 · Aug 18, 2025
-
CYBER-WARRIOR-SEC/CVE-2024-28397-js2py-Sandbox-Escape ★ 0 · Jun 21, 2024
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- pyload-ng js2py - Remote Code Execution http/cves/2024/CVE-2024-28397.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | js2py | <= 0.74 | — | GHSA-h95x-26f3-88hr |
Advisories 3
- openSUSE-SU-2026:11322-1 python313-Js2Py-0.74-6.1 on GA media SUSE / openSUSE Security Updates · Jul 22, 2026
- openSUSE-SU-2024:14086-1 python310-Js2Py-0.74-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2272-1 Security update for python-Js2Py SUSE / openSUSE Security Updates · Feb 4, 2026