Server-Side Template Injection in Dynaconf Configuration Management Tool
CVE-2026-33154
Key Information:
Badges
What is CVE-2026-33154?
Dynaconf, a popular configuration management tool for Python, has been found to have a vulnerability that allows for Server-Side Template Injection (SSTI). This flaw arises from the unsafe evaluation of template expressions in configuration values, particularly when the jinja2 package is installed. Without a sandboxed environment, malicious users could manipulate the template evaluation process, leading to potential security breaches. Fortunately, this issue has been addressed in Dynaconf version 3.2.13, emphasizing the importance of keeping software up to date to mitigate such vulnerabilities.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
dynaconf < 3.2.13
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.