PYSEC-2026-1476

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/js2py/PYSEC-2026-1476.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-1476

Aliases

CVE-2024-28397
GHSA-h95x-26f3-88hr

Published

2026-07-07T14:34:35.127086Z

Modified

2026-07-07T17:46:46.023026391Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

js2py allows remote code execution

Details

An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

References

Affected packages

PyPI / js2py

Package

Name: js2py; View open source insights on deps.dev
Purl: pkg:pypi/js2py

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.74

Affected versions

0.*

0.1

0.2

0.21

0.22

0.23

0.25

0.26

0.27

0.28

0.29

0.30

0.31

0.32

0.33

0.35

0.36

0.37

0.39

0.40

0.41

0.42

0.43

0.44

0.47

0.48

0.49

0.50

0.51

0.52

0.53

0.54

0.55

0.56

0.57

0.58

0.59

0.60

0.61

0.62

0.63

0.66

0.67

0.68

0.69

0.70

0.71

0.72

0.74

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/js2py/PYSEC-2026-1476.yaml"