CVE-2024-28397

Published Jun 20, 2024

Last updated 2 years ago

js2py

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-28397 is a code injection vulnerability found in the `js2py` Python library, which functions as a JavaScript to Python translator and interpreter. This flaw specifically impacts the `js2py.disable_pyimport()` function, a feature designed to create a sandboxed environment by preventing JavaScript code from importing Python modules. However, the vulnerability allows an attacker to bypass this security mechanism. Through a specially crafted API call, an attacker can exploit this vulnerability to escape the intended sandbox and gain the ability to execute arbitrary code within the Python environment. This issue affects `js2py` versions up to and including 0.74.

Description: An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.
Source: cve@mitre.org
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 5.3
Impact score: 3.4
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Severity: MEDIUM

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-94

Hype score: Not currently trending

References