CVE-2026-33154: 
Python vulnerability analysis and mitigation

CVE-2026-33154 is a Server-Side Template Injection (SSTI) / Remote Code Execution vulnerability in the Python configuration management library dynaconf, affecting all versions up to and including 3.2.12. The flaw resides in the @Jinja and @Format string resolvers, which evaluate template expressions embedded in configuration values without a sandboxed environment. It was discovered by researcher redyank, disclosed via GitHub Security Advisory GHSA-pxrr-hq57-q35p on March 18, 2026, and published to the NVD on March 20, 2026. The CVSS v3.1 base score is 7.5 (High) per the GitHub Advisory, while Feedly's estimate places it at 8.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of special elements used in a template engine (CWE-1336) and improper control of code generation (CWE-94), compounded by OS command injection risk (CWE-78). Dynaconf's @Jinja resolver passes configuration values directly to a full, unsandboxed Jinja2 rendering context, allowing attackers to traverse Python's internal object graph via objects like cycler to reach __globals__ and import the os module — ultimately calling os.popen() for arbitrary command execution. The @Format resolver similarly allows Python string formatting with internal objects, enabling traversal such as {this.__class__.__init__.__globals__[os].environ} to expose secrets. Exploitation requires that an attacker control a configuration source (environment variable, .env file, CI/CD secret, or container environment), which is a realistic precondition in modern cloud-native deployments (GitHub Advisory, dynaconf Security Advisory).

Successful exploitation grants an attacker full control over the running application process, enabling arbitrary OS command execution on the host system, exfiltration of sensitive environment variables (API keys, database credentials, internal service tokens), and complete compromise of application secrets. Because configuration values in modern deployments frequently originate from CI/CD pipelines, container orchestration systems (e.g., Kubernetes), or environment injection mechanisms, a supply-chain or infrastructure-level attacker could trigger this remotely at scale. The confidentiality, integrity, and availability impacts are all rated High (GitHub Advisory, dynaconf Security Advisory).

A public proof-of-concept (PoC) exploit is available in the official GitHub Security Advisory, consisting of a runnable Python script that injects a malicious Jinja2 template via an environment variable to achieve arbitrary command execution (dynaconf Security Advisory). The EPSS score is approximately 0.045% (low near-term exploitation probability), and there is no current evidence of in-the-wild exploitation or threat actor attribution. The vulnerability is not listed in the CISA KEV catalog as of the time of this report. Detection plugins are available in Nessus (IDs 303261, 304218) and Qualys (ID 6633672) (Feedly).

1. Identify target: Determine that the target application uses dynaconf version ≤ 3.2.12 with the jinja2 package installed, and that the attacker can influence a configuration source (e.g., environment variables, .env files, CI/CD pipeline secrets, or container environment variables).
2. Craft malicious payload: Construct a Jinja2 SSTI payload that traverses Python's object graph to reach the os module. Example payload for the @Jinja resolver:

   @jinja {{ cycler.__init__.__globals__.os.popen('id').read() }}

3. Inject via configuration source: Set the malicious value in a dynaconf-recognized configuration source. For environment variables, prefix with DYNACONF_:

   import os
   os.environ["DYNACONF_RCE"] = "@jinja {{ cycler.__init__.__globals__.os.popen('id').read() }}"

   In real-world scenarios, this could be injected via a compromised CI/CD secret, a malicious .env file, or a container environment variable.
4. Trigger evaluation: Cause the application to instantiate Dynaconf() and access the injected setting (e.g., settings.RCE). Dynaconf will evaluate the template expression without sandboxing.
5. Achieve code execution: The os.popen() call executes the OS command on the host and returns the output. Replace 'id' with any desired command (e.g., a reverse shell payload) to achieve full system compromise.
6. Alternatively, use @Format for secret exfiltration: Inject @format {this.__class__.__init__.__globals__[os].environ} to dump all environment variables, exposing API keys and credentials (dynaconf Security Advisory).

• Environment / Configuration: Presence of DYNACONF_* environment variables containing @jinja, @format, __globals__, __init__, cycler, popen, or similar Python introspection patterns in container or process environments.
• File System: Unexpected .env files or configuration files containing Jinja2 template expressions with Python object traversal syntax (e.g., cycler.__init__.__globals__).
• Logs: Application logs showing errors or unexpected output from dynaconf settings resolution, particularly stack traces involving jinja2 template rendering or os.popen calls.
• Process: Unusual child processes spawned by the Python application process (e.g., sh, bash, curl, wget, python) that are not part of normal application behavior.
• Network: Unexpected outbound connections from the application host to external IPs, particularly following configuration load events (e.g., application startup or restart in CI/CD pipelines).
• CI/CD: Anomalous or unauthorized modifications to pipeline secrets, environment variable definitions, or .env files in source repositories (dynaconf Security Advisory).

Upgrade dynaconf to version 3.2.13 or later, which fixes both the @Jinja and @Format templating vulnerabilities by implementing proper security boundaries (dynaconf Release 3.2.13, Patch Commit). As an interim workaround where upgrading is not immediately possible, replace unsandboxed Jinja2 rendering with jinja2.sandbox.SandboxedEnvironment and restrict @Format usage to fully trusted, static values only. Additionally, audit and restrict all configuration sources — especially CI/CD pipeline secrets, container environment variables, and .env files — to prevent injection of malicious template expressions (dynaconf Security Advisory, Red Hat Bugzilla). OpenSUSE and Ubuntu have also released updated packages for their distributions (Feedly).

The vulnerability was reported by researcher redyank and patched promptly by dynaconf maintainer pedro-psb in version 3.2.13 on March 17–18, 2026 (dynaconf Release 3.2.13). Red Hat tracked the issue via Bugzilla (Bug 2449774) and assigned medium severity, with 14 users on the CC list indicating broad internal interest (Red Hat Bugzilla). Security blog infinitsec.net published a write-up shortly after disclosure, and the vulnerability received coverage on Mastodon and Bluesky within days of publication. OpenSUSE and Ubuntu subsequently issued security advisories for their packaged versions of python-dynaconf.