PYSEC-2026-2147

vendorUSosv

view advisory published 2026-03-20Licence: CC-BY-4.0

dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-33154US	high8.1	0.54% (45th)	Exploit	2026-03-20
dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation i…

references

External citations — patches, advisories, analysis.

https://github.com/dynaconf/dynaconf/commit/2fbb45ee36b8c0caa5b924fe19f3c1a5e8603fa7FIX
https://github.com/dynaconf/dynaconf/releases/tag/3.2.13ADVISORY
https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35pEVIDENCE

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan