{"id":"CVE-2014-6633","aliases":["GHSA-m9jj-5qvj-5fhx","PYSEC-2018-59","PYSEC-2026-3390"],"title":"Tryton vulnerable to arbitrary command execution","summary":"Tryton vulnerable to arbitrary command execution","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"tryton","product":"tryton","ecosystem":"pip","affected":["tryton < 2.4.15","tryton >= 2.6.0, < 2.6.14","tryton >= 2.8.0, < 2.8.11","tryton >= 3.2.0, < 3.2.3","trytond >= 2.4.0, < 2.4.15","trytond >= 2.6.0, < 2.6.14","trytond >= 2.8.0, < 2.8.11","trytond >= 3.2.0, < 3.2.3","trytond >= 3.0.0, < 3.0.7"],"patched":["tryton 2.4.15","tryton 2.6.14","tryton 2.8.11","tryton 3.2.3","trytond 2.4.15","trytond 2.6.14","trytond 2.8.11","trytond 3.2.3","trytond 3.0.7"],"published":"2022-05-14","updated":"2026-07-13","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-m9jj-5qvj-5fhx","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6633"},{"url":"https://github.com/tryton/trytond/commit/19fc2a01357b7638041953326e404f51d96fad06"},{"url":"https://github.com/tryton/trytond/commit/3e4c2b7e8c7b3358597a0d484fa98f45483ee92a"},{"url":"https://bugs.tryton.org/issue4155"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2018-59.yaml"},{"url":"https://github.com/tryton/trytond"},{"url":"http://www.tryton.org/posts/security-release-for-issue4155.html"}],"tags":["osv","pip"],"epss":0.02146,"epssPercentile":0.8104,"ingestedAt":"2026-07-13T18:58:00.515Z","slug":"CVE-2014-6633","body":"## Overview\n\nThe `safe_eval` function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the `collection.domain` in the webdav module or (2) the formula field in the `price_list` module.\n\n## Affected packages\n\n- `tryton < 2.4.15`\n- `tryton >= 2.6.0, < 2.6.14`\n- `tryton >= 2.8.0, < 2.8.11`\n- `tryton >= 3.2.0, < 3.2.3`\n- `trytond >= 2.4.0, < 2.4.15`\n- `trytond >= 2.6.0, < 2.6.14`\n- `trytond >= 2.8.0, < 2.8.11`\n- `trytond >= 3.2.0, < 3.2.3`\n- `trytond >= 3.0.0, < 3.0.7`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `tryton 2.4.15`\n- `tryton 2.6.14`\n- `tryton 2.8.11`\n- `tryton 3.2.3`\n- `trytond 2.4.15`\n- `trytond 2.6.14`\n- `trytond 2.8.11`\n- `trytond 3.2.3`\n- `trytond 3.0.7`","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}