CVE-2026-33154

Dynaconf SSTI 漏洞报告 摘要 Dynaconf 由于 @Jinja 解析器中的不安全模板求值，存在服务端模板注入（SSTI）漏洞。当安装了jinja2 包时，Dynaconf 会在无沙箱环境下求值嵌入在配置值中的模板表达式。 如果攻击者能够影响配置源，例如： 环境变量 .env 文件 容器环境配置 CI/CD 密钥 ...他们就可以在主机系统上执行任意操作系统命令 。此外，@Format 解析器允许对象图遍历，这可能会暴露敏感的运行时对象和环境变量。 详细信息 该漏洞的产生是因为 Dynaconf 的字符串解析器缺乏适当的安全边界。 1. @Jinja 解析器 @Jinja...

Security update for python-dynaconf (important)

openSUSE security update: security update for python-dynaconf ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20429-1 Rating: important References: bsc1260063 Cross-References: CVE-2026-33154 Affected Products: openSUSE Leap 16.0...

OPENSUSE-SU-2026:20429-1 Security update for python-dynaconf

This update for python-dynaconf fixes the following issues: Changes in python-dynaconf: - CVE-2026-33154: Server-Side Template Injection in the @Jinja resolver bsc1260063...

CVE-2026-33154 dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver

dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection SSTI due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in...

CVE-2026-33154 dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver

dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection SSTI due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in...

CVE-2026-33154

CVE-2026-33154 – Dynaconf SSTI (Jinja) vulnerability : Dynaconf for Python is vulnerable before version 3.2.13 due to unsafe template evaluation in the @Jinja resolver when the jinja2 package is present. This can allow Server-Side Template Injection in configuration values. The issue is fixed in ...

CVE-2026-33154 dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver

dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection SSTI due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in...

GHSA-PXRR-HQ57-Q35P dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver

Summary Dynaconf is vulnerable to Server-Side Template Injection SSTI due to unsafe template evaluation in the @jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. If an attacker can...

dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver

Summary Dynaconf is vulnerable to Server-Side Template Injection SSTI due to unsafe template evaluation in the @jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. If an attacker can...