CVE-2024-28397 in js2py
Summary
by MITRE • 06/20/2024
An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/01/2026
The vulnerability identified as CVE-2024-28397 resides within the js2py library, specifically within the js2py.disable_pyimport() function, which is designed to prevent Python import operations from within JavaScript code executed through the js2py interpreter. This security flaw represents a critical oversight in the library's security model, as it allows attackers to bypass intended restrictions and execute arbitrary code on systems where js2py is deployed. The js2py library serves as a JavaScript to Python converter, enabling JavaScript code execution within Python environments, making it a potentially dangerous component when improperly secured.
The technical implementation of this vulnerability stems from insufficient validation and sanitization within the disable_pyimport() function. When attackers craft specific API calls that exploit the function's behavior, they can circumvent the intended security restrictions designed to prevent Python import operations. This flaw operates at the intersection of sandboxing and code execution, where the boundary between JavaScript and Python execution contexts becomes porous. The vulnerability essentially allows an attacker to inject malicious code that can execute with the privileges of the Python process, potentially leading to complete system compromise.
The operational impact of this vulnerability extends beyond simple code execution, as it can enable attackers to perform various malicious activities including data exfiltration, system reconnaissance, privilege escalation, and persistence mechanisms. Systems utilizing js2py for JavaScript execution, particularly in environments where untrusted JavaScript code is processed, become vulnerable to remote code execution attacks. This vulnerability is particularly concerning in web applications, automated testing frameworks, and development environments where js2py is used to execute JavaScript code from external sources without proper input validation.
Security mitigations for this vulnerability should prioritize immediate library updates to versions that address the flaw, as the primary fix involves correcting the implementation of the disable_pyimport() function to properly enforce security boundaries. Organizations should implement additional layers of protection including input validation, sandboxing measures, and runtime monitoring to detect potential exploitation attempts. The vulnerability aligns with CWE-78 and CWE-94 categories, representing command injection and code injection flaws respectively, while also mapping to ATT&CK techniques such as T1059.007 for JavaScript execution and T1078 for valid accounts usage. System administrators should also consider implementing network segmentation, privilege separation, and regular security assessments to reduce the attack surface and prevent exploitation of this vulnerability across their infrastructure.