CVE-2026-33154High· 7.5▾ MidnightPoC availableA flaw was found in dynaconf, a Python configuration management tool. This Server-Side Template Injection (SSTI) vulnerability occurs due to unsafe template evaluation in the @Jinja resolver when the jinja2 package is installed. A remote a…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.5%
1 GitHub repo
0.5% → 0.6%
Last analysed / modified upstream
A flaw was found in dynaconf, a Python configuration management tool. This Server-Side Template Injection (SSTI) vulnerability occurs due to unsafe template evaluation in the @Jinja resolver when the jinja2 package is installed. A remote attacker could exploit this by embedding malicious template expressions in configuration values, which are then processed without a sandboxed environment. This could lead to arbitrary code execution on the affected system.
dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection — rated Moderate by Red Hat. Released 2026-03-20, updated 2026-10-02.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For detailed instructions how to apply this update, refer to:
Release Notes:
Provisioning tokens are now required for all Operating System entries with Redhat family set. Attempts to download a unattended template without valid token will lead to “a provisioning token is required but a valid one was not provided” error.
This changed behavior will lead to inability to use Gener… https://access.redhat.com/errata/RHSA-2026:74506 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:34160 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:74505
Workarounds / mitigations:
Affected packages:
dynaconf < 3.2.13Patched in:
dynaconf 3.2.13Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-24688Medium· 5.3pypdf: pypdf Infinite Loop when processing outlines/bookmarks (CVE-2026-24688)
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2026-114138High· 7.5djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing (CVE-2026-114138)
CVE-2026-114136High· 7.5djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (CVE-2026-114136)
CVE-2026-41481Medium· 6.5langchain-text-splitters: LangChain: Information Disclosure via Server-Side Request Forgery (SSRF) Redirect Bypass (CVE-2026-41481)
CVE-2026-54757High· 7.8compliance-trestle: Trestle: Remote Code Execution via Server-Side Template Injection (CVE-2026-54757)