CVE-2026-33154 Details

A remote code execution vulnerability has been identified in Dynaconf, a Python configuration management tool, in versions prior to 3.2.13. The issue arises from server-side template injection (SSTI) due to unsafe template evaluation in the Jinja resolver. When the Jinja2 package is installed, Dynaconf processes template expressions in configuration values without a sandboxed environment. This vulnerability allows attackers to execute arbitrary OS commands on the host system by injecting malicious templates through various configuration sources, such as environment variables, .env files, container environment settings, and CI/CD secrets. Additionally, the @Format resolver can be exploited to access sensitive runtime objects and environment variables.

Users are advised to update Dynaconf to version 3.2.13 or later, where this vulnerability has been patched. For those using Jinja2 templates, ensure to use the SandboxedEnvironment to prevent execution of untrusted code.