CVE-2014-6633 json
Tryton vulnerable to arbitrary command execution
published 2018-04-12 8 y ago modified 2026-07-13 3 mo ago also GHSA-m9jj-5qvj-5fhx , PYSEC-2018-59 , PYSEC-2026-3390 , EUVD-2018-0143
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.6%
- EPSS 2.6% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.
Patch / fix
- pypi tryton 2.4.15, 2.6.14, 2.8.11, 3.2.3
- pypi trytond 2.4.15, 2.6.14, 2.8.11, 3.0.7, 3.2.3
- tryton tryton 2.4.15, 2.6.14, 2.8.11, 3.0.7, 3.2.3
- tryton-server Debian 14, Debian 13, Debian 12 3.2.3-1
debian advisories DEBIAN-CVE-2014-6633
Exploit prediction
2.58% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
| GitHub | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | tryton | <2.4.15 >=2.6.0, <2.6.14 >=2.8.0, <2.8.11 >=3.2.0, <3.2.3 |
2.4.15 2.6.14 2.8.11 3.2.3 |
| pypi | trytond | >=2.4.0, <2.4.15 >=2.6.0, <2.6.14 >=2.8.0, <2.8.11 >=3.2.0, <3.2.3 >=3.0.0, <3.0.7 |
2.4.15 2.6.14 2.8.11 3.2.3 3.0.7 |
Classification
- Weakness
-
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
-
github.com
/tryton/trytond/commit/19fc2a01357b7638041953326e404f51d96fad06
web
-
github.com
/tryton/trytond/commit/3e4c2b7e8c7b3358597a0d484fa98f45483ee92a
web
-
tryton.org
/posts/security-release-for-issue4155.html
web, vendor-advisory
-
bugs.tryton.org
/issue4155
web, issue-tracking
-
nvd.nist.gov
/vuln/detail/CVE-2014-6633
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2018-59.yaml
web
-
github.com
/tryton/trytond
package
-
pypi.org
/project/tryton
package
-
github.com
/advisories/GHSA-m9jj-5qvj-5fhx
advisory
Sources
- CVE List CVE-2014-6633
- GitHub Advisory GHSA-m9jj-5qvj-5fhx
- NVD CVE-2014-6633
- OSV PYSEC-2026-3390
- OSV PYSEC-2018-59
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.