Skip to main content
ExploitPublished

Js2Py 0.74 · RCE

Source Exploit-DB RSS Feed

0
Severity
Critical

Rated by Threat Radar

Data as of 6 May 2026, 02:38 UTC

What to do

AI-suggested

Until an official fix is available, restrict usage of Js2Py 0.74 in untrusted environments and monitor for updates from the vendor.

Description

Js2Py 0.74 - RCE

Indicators of compromise

Exploit source code

Exploit code for Js2Py 0.74 - RCE3,849 characters
Exploit Title: Js2Py 0.74 -  RCE
Date: 2026-02-03
Exploit Author: Ali Sünbül (xeloxa) <alisunbul@proton.me>
Author Page: https://github.com/xeloxa
Vendor Homepage: https://github.com/PiotrDabkowski/Js2Py
Software Link: https://pypi.org/project/Js2Py/
Version: <= 0.74
Tested on: macOS, Linux (Python 3.x)
CVE: CVE-2024-28397

Description:
  This tool generates a malicious JavaScript payload to exploit CVE-2024-28397.
  The vulnerability in `js2py` allows escaping the sandbox via `Object.getOwnProp…

References

Community reviews

Loading reviews…