PT-2026-26201 · Cycler+2 · Cycler+2

Redyank · Published 2026-03-18 · Updated 2026-05-06 · CVE-2026-33154

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dynaconf versions prior to 3.2.13

Description dynaconf is susceptible to Server-Side Template Injection (SSTI) due to insecure template evaluation within the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. Attackers influencing configuration sources—such as environment variables, .env files, container environment configuration, or CI/CD secrets—can execute arbitrary OS commands on the host system. The @format resolver also allows object graph traversal, potentially exposing sensitive runtime objects and environment variables. A proof-of-concept (PoC) demonstrates command execution using the cycler object to access Python’s os module and execute commands. Successful exploitation can lead to arbitrary OS command execution, access to sensitive environment variables, compromise of application secrets, and full compromise of the running application process. The vulnerability can be remotely exploitable in real-world deployments due to the potential for configuration values to originate from CI/CD pipelines, container orchestration systems, or environment injection.

Recommendations versions prior to 3.2.13: Upgrade to version 3.2.13 or later to address the vulnerability. versions prior to 3.2.13: Use Jinja2 sandbox for template rendering. versions prior to 3.2.13: Restrict @format usage to trusted values.

Exploit

Fix

RCE

Code Injection

OS Command Injection

Weakness Enumeration

CWE-94

CWE-78

CWE-1336

Related Identifiers

CVE-2026-33154

GHSA-PXRR-HQ57-Q35P

OPENSUSE-SU-2026:10411-1

OPENSUSE-SU-2026:20429-1

USN-8231-1

Affected Products

Jinja2

Cycler

Dynaconf

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33154.json · Exploit
• https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35p · Vendor Advisory
• https://github.com/dynaconf/dynaconf/commit/2fbb45ee36b8c0caa5b924fe19f3c1a5e8603fa7 · Patch
• https://ubuntu.com/security/notices/USN-8231-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33154 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pxrr-hq57-q35p · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10411-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33154 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33154 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20429-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33154 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33154 · Security Note
• https://ubuntu.com/security/CVE-2026-33154 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33154 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8231-1 · Vendor Advisory