CVE-2024-28397
HIGH 8.8EPSS 4.5%
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
- CVSS v4.0
- 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS v3.1
- 5.3 MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - CVSS v3.1
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 4.55% chance of exploitation in the next 30 days, 91th percentile
- Nuclei
- medium · CWE-94
- Published
- 2024-06-20
- Updated
- 2024-08-02
Proof-of-concept exploits (22)
- 0timeday/exploit-js2py1★ · 2025-12-13
- 0xDTC/js2py-Sandbox-Escape-CVE-2024-28397-RCE0★ · 2025-09-15
- CYBER-WARRIOR-SEC/CVE-2024-28397-js2py-Sandbox-Escape0★ · 2024-06-29
- ExtremeUday/Remote-Code-Execution-CVE-2024-28397-pyload-ng-js2py-0★ · 2026-07-14
- Leilamag/CodeTwoRCEExploit0★ · 2025-08-27
- Naved124/CVE-2024-28397-js2py-Sandbox-Escape0★ · 2025-08-28
- harutomo-jp/CVE-2024-28397-RCE1★ · 2025-08-18
- kyl0-ST12/CVE_2024_28397---js2py-RCE0★ · 2025-08-25
- naclapor/CVE-2024-2839712★ · 2025-09-09
- nelissandro/CVE-2024-28397-Js2Py-RCE0★ · 2025-09-24
- releaseown/exploit-js2py1★ · 2025-12-13
- vitaciminIPI/CVE-2024-28397-RCE0★ · 2025-09-17
- waleed-hassan569/CVE-2024-28397-command-execution-poc5★ · 2025-08-17
- 3z-p0wn/CVE-2024-28397-exploit
- D3ltaFormation/CVE-2024-28397-Js2Py-RCE
- GhostOverflow/CVE-2024-28397-command-execution-poc
- L1337Xi/CVE-2024-28397-Exploit-Automation
- Udayveer17/Remote-Code-Execution-CVE-2024-28397-pyload-ng-js2py-
- somisec/CVE-2024-28397-Reverse-Shell
- xeloxa/CVE-2024-28397-Js2Py-RCE-Exploit
- y0naldez/CVE-2024-28397-Js2Py-RCE
- Marven11/CVE-2024-28397-js2py-Sandbox-Escape72★ · 2025-08-28