Log in Start free

Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M

CVE-2026-33154dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver

High 7.5

In plain English

A high-severity code injection in dynaconf from dynaconf. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 54.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12python-dynaconfno fix listedDEBIAN-CVE-2026-33154
Debian:13python-dynaconf3.1.7-2+deb13u1DEBIAN-CVE-2026-33154
Debian:14python-dynaconf3.2.13-1DEBIAN-CVE-2026-33154
PyPIdynaconf3.2.13GHSA-pxrr-hq57-q35p
PyPIdynaconf3.2.13PYSEC-2026-2147
Ubuntu:24.04:LTSpython-dynaconf3.1.7-2ubuntu0.24.04.1USN-8231-1
Ubuntu:24.04:LTSpython-dynaconf3.1.7-2ubuntu0.24.04.1UBUNTU-CVE-2026-33154
Ubuntu:25.10python-dynaconf3.1.7-2ubuntu0.25.10.1UBUNTU-CVE-2026-33154
Ubuntu:25.10python-dynaconf3.1.7-2ubuntu0.25.10.1USN-8231-1
Ubuntu:26.10python-dynaconfno fix listedUBUNTU-CVE-2026-33154

Affected products (as reported)

VendorProductVersions
dynaconf dynaconf < 3.2.13

Weakness: CWE-1336, CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References