SSTI arises from dynaconf's @Jinja resolver evaluating template expressions in configuration values without a sandbox, enabling an attacker to inject Python expressions that are executed on the server. When the jinja2 package is present, the evaluator can run arbitrary code, allowing the attacker to read, modify, or delete data, or exfiltrate sensitive information. The vulnerability can be triggered by malicious configuration entries, making it a high‑safety risk for any deployment exposing configuration files to untrusted input.

The affected product is the dynaconf configuration tool for Python. Versions earlier than 3.2.13 are vulnerable, as documented by the vendor. Any deployment that relies on dynaconf before the 3.2.13 release, and has the jinja2 dependency installed, is susceptible to this remote code execution flaw.

The CVSS score of 7.5 indicates a high severity level, while the EPSS score of less than 1% suggests that exploitation is currently unlikely on a broad scale. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no public exploits have been reported. An attacker can exploit the vulnerability by injecting malicious template syntax into configuration files or environments where dynaconf processes non‑trusted data. The analysis indicates that the most probable attack vector is through file‑based configuration injection, given that dynaconf evaluates templates in those contexts.