Permalink
CVE-2026-33154
7.5 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): HIGH
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): HIGH
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse accepted
- @LeSuisse published on GitHub
dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver
dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13.
References
- https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35p x_refsource_CONFIRM
- https://github.com/dynaconf/dynaconf/commit/2fbb45ee36b8c0caa5b924fe19f3c1a5e8603fa7 x_refsource_MISC
- https://github.com/dynaconf/dynaconf/releases/tag/3.2.13 x_refsource_MISC
Affected products
dynaconf
- ==< 3.2.13
Matching in nixpkgs
pkgs.python312Packages.dynaconf
Dynamic configurator for Python Project
pkgs.python313Packages.dynaconf
Dynamic configurator for Python Project
pkgs.python314Packages.dynaconf
Dynamic configurator for Python Project