GitHub Advisoryadvisory · PyPI

GHSA-h95x-26f3-88hr js2py allows remote code execution

HIGH Published 2024-06-20 Modified 2024-07-05 Official page ↗

Aliases: CVE-2024-28397
Ecosystem: PyPI
Packages: js2py
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses: CWE-94
Reviewed: 2024-06-20

Affected packages

• PyPI js2py: <= 0.74 (no fix yet)

Description

An issue in the component `js2py.disable_pyimport()` of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

Related

Alias · CVE (1)

CVE-2024-28397 An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call. vulnerability

Weakness · CWE (1)

CWE-94 Improper Control of Generation of Code weakness

References