VDB
DEBIAN-CVE-2026-33154
DEBIAN-CVE-2026-33154
PUBLISHED
CVSS 8.100000381469727 HIGH
dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13.
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | python-dynaconf | 3.1.7-3, 0, 3.1.7-2 |
| Debian:14 | python-dynaconf | 3.2.12-1, 3.1.7-3, 3.1.7-2 |
| Debian:11 | python-dynaconf | 3.2.13-1, 3.1.7-2, 3.1.7-3 |
| Debian:13 | python-dynaconf | 3.2.13-1, 3.2.12-1, 3.1.7-3 |
Exploit Intelligence
- CVE-2026-33154(RCE @jinja resolver) (github-poc-repo)
- CVE-2026-33154(RCE @jinja resolver) (github-poc)
Timeline
- Mar 20, 2026 CVE Published
- Apr 28, 2026 CVE Updated