Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33154 dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe templat… https://www.cve.org/CVERecord?id=CVE-2026-33154
Post summary
The post discloses that Dynaconf (pre‑3.2.13) has a Server‑Side Template Injection vulnerability, without mentioning patches, exploits, or active use.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-33154 - dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver Intel Report: https://ift.tt/B4T8uyl
Post summary
An alert announces CVE-2026-33154 in dynaconf, highlighting Remote Code Execution via insecure Jinja template evaluation, with no patch or exploit details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | dynaconf | dynaconf | - | - | - |