CVE-2024-28397

What it actually does

Bypasses the disable_pyimport() restriction in js2py up to v0.74, enabling arbitrary Python code execution from within a JavaScript execution context.

Why it matters to the business

Attackers can run unauthorized commands on systems using this library, risking data exposure, system takeover, or further compromise in applications that process untrusted JavaScript.

How an attack unfolds

An attacker supplies a crafted JavaScript payload through an API call that circumvents the disabled pyimport mechanism in js2py, resulting in arbitrary code execution on the host. The issue has been weaponized, lowering the barrier for exploitation in affected environments.

How to fix it

Upgrade js2py to the latest version beyond 0.74. Audit all code paths that invoke js2py, restrict its use with untrusted input, and consider alternative libraries where possible.

How to confirm the fix worked

Confirm the deployed js2py version exceeds 0.74, retest disable_pyimport() behavior with sample payloads, and review dependency manifests for the vulnerable component.

Typical attack path

1. Locate an application integrating a vulnerable js2py version
2. Prepare a malicious JavaScript payload targeting the pyimport bypass
3. Deliver the payload via a crafted API call to the js2py component
4. Trigger execution to achieve code execution on the underlying system

How to detect it

Review application logs for unexpected Python module imports or subprocess activity originating from js2py execution contexts; correlate with inbound JavaScript payloads.

What your security team should do

• Prioritize upgrading js2py in all environments given weaponized exploit availability
• Inventory applications and dependencies using js2py
• Add runtime restrictions and input sanitization around JavaScript processing
• Monitor for post-exploitation activity following any suspected exposure