CVE-2024-39205

Advisory

pyload-ng affected versions are vulnerable to remote code execution (RCE) when running on Python 3.11 or below. The vulnerability stems from a sandbox escape in js2py (CVE-2024-28397) used by the /flash/addcrypted2 API endpoint. Although designed for localhost connections, this restriction can be bypassed using HTTP headers, allowing attackers to execute arbitrary shell commands on the victim's server. The issue affects all Python versions up to 3.11, as pyload-ng doesn't use js2py in Python 3.12+. Users are strongly advised to update to the latest version or migrate to Python 3.12+ if possible.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-r9pp-r4xf-597r
• https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28397
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39205