CVE-2026-33154: dynaconf Remote Code Execution via Insecure Template Evaluation
Summary
CVE-2026-33154: dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver. Affects dynaconf versions < 3.2.13. Fixed in 3.2.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dynaconf is a powerful configuration management tool for Python applications that allows users to manage settings across different environments seamlessly. It supports various configuration sources, including environment variables, .env files, and CI/CD secrets. However, it is vulnerable to a critical security issue that arises from unsafe template evaluation in its @jinja resolver, potentially allowing attackers to execute arbitrary commands on the host system.
Vulnerability Detail
Dynaconf is susceptible to Server-Side Template Injection (SSTI) due to the lack of a sandboxed environment when evaluating template expressions in configuration values. If an attacker can manipulate configuration sources, they can execute arbitrary OS commands. The vulnerability stems from the @jinja resolver, which allows full Jinja2 evaluation without security boundaries, enabling access to Python's internal attributes. Additionally, the @format resolver permits object graph traversal, exposing sensitive runtime objects and environment variables, leading to severe security risks.
How To Fix
Latest published version: 3.3.5 as of 22 Oct 2026
pip install --upgrade "dynaconf==3.3.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.13
This is the first release that contains the fix.
pip install --upgrade "dynaconf==3.2.13"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can use the Jinja2 sandbox for template rendering to prevent unsafe evaluations. Here is an example code snippet:
from jinja2.sandbox import SandboxedEnvironment env = SandboxedEnvironment() template = env.from_string('{{ config_value }}') safe_value = template.render(config_value=user_input)
Conclusion
The dynaconf package is vulnerable to a significant security issue that can lead to remote code execution due to insecure template evaluation. It is crucial to update to the patched version or implement the recommended workarounds to protect your application from potential exploitation.
See every vulnerability recorded for dynaconf →
FAQ
CVE-2026-33154 is a vulnerability in the dynaconf package that allows for remote code execution through insecure template evaluation.
An attacker can exploit this vulnerability by manipulating configuration sources such as environment variables or .env files to execute arbitrary OS commands.
Successful exploitation can lead to arbitrary command execution, exposure of sensitive environment variables, and full compromise of the application process.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner for more information.
If immediate updates are not possible, implement the provided workaround using the Jinja2 sandbox for template rendering to mitigate the risk temporarily.
