PYSEC-2026-3392

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/trytond/PYSEC-2026-3392.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-3392
Aliases
Published
2026-07-09T16:49:45.054237Z
Modified
2026-07-13T16:43:06.410889598Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
XML Entity Expansion in trytond and proteus
Details

An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.

References

Affected packages

PyPI / trytond

Package

Name
trytond
View open source insights on deps.dev
Purl
pkg:pypi/trytond

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
5.0.46
Introduced
6.0.0
Fixed
6.0.16
Introduced
6.1.0
Fixed
6.2.6

Affected versions

5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.20
5.0.21
5.0.22
5.0.23
5.0.24
5.0.25
5.0.26
5.0.27
5.0.28
5.0.29
5.0.30
5.0.31
5.0.32
5.0.33
5.0.34
5.0.35
5.0.36
5.0.37
5.0.38
5.0.39
5.0.40
5.0.41
5.0.42
5.0.43
5.0.44
5.0.45
6.*
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
6.0.10
6.0.11
6.0.12
6.0.13
6.0.14
6.0.15
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.2.5

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/trytond/PYSEC-2026-3392.yaml"