cve/2024/CVE-2024-28397.md

### [CVE-2024-28397](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28397)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

### POC

#### Reference
- https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape

#### Github
- https://github.com/0xDTC/js2py-Sandbox-Escape-CVE-2024-28397-RCE
- https://github.com/CYBER-WARRIOR-SEC/CVE-2024-28397-js2py-Sandbox-Escape
- https://github.com/ExtremeUday/Remote-Code-Execution-CVE-2024-28397-pyload-ng-js2py-
- https://github.com/Leilamag/CodeTwoRCEExploit
- https://github.com/Marven11/CVE-2024-28397
- https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape
- https://github.com/Marven11/CVE-2024-39205-Pyload-RCE
- https://github.com/Marven11/Marven11
- https://github.com/Naved124/CVE-2024-28397-js2py-Sandbox-Escape
- https://github.com/harutomo-jp/CVE-2024-28397-RCE
- https://github.com/kyl0-ST12/CVE_2024_28397---js2py-RCE
- https://github.com/naclapor/CVE-2024-28397
- https://github.com/nelissandro/CVE-2024-28397-Js2Py-RCE
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/releaseown/exploit-js2py
- https://github.com/vitaciminIPI/CVE-2024-28397-RCE
- https://github.com/waleed-hassan569/CVE-2024-28397-command-execution-poc
- https://github.com/zulloper/cve-poc