---
id: CVE-2014-6633
aliases:
  - GHSA-m9jj-5qvj-5fhx
  - PYSEC-2018-59
  - PYSEC-2026-3390
title: Tryton vulnerable to arbitrary command execution
summary: Tryton vulnerable to arbitrary command execution
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: tryton
product: tryton
ecosystem: pip
affected:
  - tryton < 2.4.15
  - 'tryton >= 2.6.0, < 2.6.14'
  - 'tryton >= 2.8.0, < 2.8.11'
  - 'tryton >= 3.2.0, < 3.2.3'
  - 'trytond >= 2.4.0, < 2.4.15'
  - 'trytond >= 2.6.0, < 2.6.14'
  - 'trytond >= 2.8.0, < 2.8.11'
  - 'trytond >= 3.2.0, < 3.2.3'
  - 'trytond >= 3.0.0, < 3.0.7'
patched:
  - tryton 2.4.15
  - tryton 2.6.14
  - tryton 2.8.11
  - tryton 3.2.3
  - trytond 2.4.15
  - trytond 2.6.14
  - trytond 2.8.11
  - trytond 3.2.3
  - trytond 3.0.7
published: '2022-05-14'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-m9jj-5qvj-5fhx'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2014-6633'
  - url: >-
      https://github.com/tryton/trytond/commit/19fc2a01357b7638041953326e404f51d96fad06
  - url: >-
      https://github.com/tryton/trytond/commit/3e4c2b7e8c7b3358597a0d484fa98f45483ee92a
  - url: 'https://bugs.tryton.org/issue4155'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2018-59.yaml
  - url: 'https://github.com/tryton/trytond'
  - url: 'http://www.tryton.org/posts/security-release-for-issue4155.html'
tags:
  - osv
  - pip
epss: 0.02146
epssPercentile: 0.8104
ingestedAt: '2026-07-13T18:58:00.515Z'
---

## Overview

The `safe_eval` function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the `collection.domain` in the webdav module or (2) the formula field in the `price_list` module.

## Affected packages

- `tryton < 2.4.15`
- `tryton >= 2.6.0, < 2.6.14`
- `tryton >= 2.8.0, < 2.8.11`
- `tryton >= 3.2.0, < 3.2.3`
- `trytond >= 2.4.0, < 2.4.15`
- `trytond >= 2.6.0, < 2.6.14`
- `trytond >= 2.8.0, < 2.8.11`
- `trytond >= 3.2.0, < 3.2.3`
- `trytond >= 3.0.0, < 3.0.7`

## Remediation

Upgrade to a patched release:

- `tryton 2.4.15`
- `tryton 2.6.14`
- `tryton 2.8.11`
- `tryton 3.2.3`
- `trytond 2.4.15`
- `trytond 2.6.14`
- `trytond 2.8.11`
- `trytond 3.2.3`
- `trytond 3.0.7`