{"id":"CVE-2026-33154","aliases":["DEBIAN-CVE-2026-33154","EUVD-2026-13790","GHSA-pxrr-hq57-q35p","PYSEC-2026-2147","RHSA-2026:34160","RHSA-2026:74503","RHSA-2026:74504","RHSA-2026:74505","RHSA-2026:74506","UBUNTU-CVE-2026-33154","USN-8231-1","openSUSE-SU-2026:10411-1","openSUSE-SU-2026:20429-1"],"status":"published","title":"dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver","description":"dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00548,"percentile":0.46206,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-1336","CWE-78","CWE-94"],"published":"2026-03-18T20:08:06Z","modified":"2026-10-28T02:30:50Z","exploits":[{"source":"pocgithub","id":"redyank/CVE-2026-33154","title":"redyank/CVE-2026-33154","date":"2026-04-03","url":"https://github.com/redyank/CVE-2026-33154"}],"fixes":[{"ecosystem":"PyPI","package":"dynaconf","fixed_in":["3.2.13"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"python-dynaconf","fixed_in":["3.1.7-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-dynaconf","fixed_in":["3.2.13-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-dynaconf","fixed_in":["3.1.7-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-dynaconf","fixed_in":["3.1.7-2ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"python-dynaconf","fixed_in":["3.1.7-2ubuntu0.25.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-dynaconf","fixed_in":["3.2.12-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-dynaconf","fixed_in":["3.2.13-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"python-dynaconf","fixed_in":["3.2.5-bp160.2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.2.12"},{"fixed":"3.2.13"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.7-2","3.1.7-3","3.2.12-1","3.2.13-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-2+deb13u1"}]}],"versions":["3.1.7-2"]},{"source":"osv","ecosystem":"Debian:14","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.13-1"}]}],"versions":["3.1.7-2","3.1.7-3","3.2.12-1"]},{"source":"osv","ecosystem":"PyPI","package":"dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.13"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.2.0","0.2.1","0.2.10","0.2.11","0.2.12","0.2.13","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.8","0.2.9","0.3.0","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.6.0","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.1.0","1.2.0","1.2.1","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.1.0","2.1.1","2.2.0","2.2.1","2.2.2","2.2.3","3.0.0","3.0.0rc1","3.0.0rc2","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.1rc1","3.1.1rc2","3.1.1rc3","3.1.1rc4","3.1.1rc5","3.1.1rc6","3.1.2","3.1.3","3.1.3rc1","3.1.4","3.1.5","3.1.7","3.1.8","3.1.9","3.2.0","3.2.1","3.2.10","3.2.11","3.2.12","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9"]},{"source":"osv","ecosystem":"PyPI","package":"dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.13"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.2.0","0.2.1","0.2.10","0.2.11","0.2.12","0.2.13","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.8","0.2.9","0.3.0","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.6.0","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.1.0","1.2.0","1.2.1","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.1.0","2.1.1","2.2.0","2.2.1","2.2.2","2.2.3","3.0.0","3.0.0rc1","3.0.0rc2","3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.1rc1","3.1.1rc2","3.1.1rc3","3.1.1rc4","3.1.1rc5","3.1.1rc6","3.1.2","3.1.3","3.1.3rc1","3.1.4","3.1.5","3.1.7","3.1.8","3.1.9","3.2.0","3.2.1","3.2.10","3.2.11","3.2.12","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.2.8","3.2.9"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-platform-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.10-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pysequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pysequoia-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pysequoia-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.5.3-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.5.3-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.19::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.19::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.19::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.18.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-2.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-2.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.20.0.11-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.19::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.19::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.2.3-2.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.2.3-2.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0.25-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0-2.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.16.0-2.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-2.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-2.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"pulpcore-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-6.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.18::el9","package":"satellite-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.18::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"pulpcore-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-6.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"python3.12-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.0.24-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"rubygem-safemode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.18::el9","package":"satellite-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.18.10-1.el9sat"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.0.2-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.0.2-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0.20-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-safemode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.8-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.8-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.8-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.8-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-safemode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-safemode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-1ubuntu0.1~esm1"}]}],"versions":["2.2.3-2","3.1.7-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-2ubuntu0.24.04.1"}]}],"versions":["3.1.7-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-2ubuntu0.25.10.1"}]}],"versions":["3.1.7-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.12-1","3.2.13-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-1ubuntu0.1~esm1"}]}],"versions":["3.1.7-2","3.1.7-3","3.2.12-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-1ubuntu0.1~esm1"}]}],"versions":["2.2.3-2","3.1.7-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-2ubuntu0.24.04.1"}]}],"versions":["3.1.7-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-2ubuntu0.25.10.1"}]}],"versions":["3.1.7-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-1ubuntu0.1~esm1"}]}],"versions":["3.1.7-2","3.1.7-3","3.2.12-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.13-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-bp160.2.1"}]}]}],"products":[{"vendor":"dynaconf","product":"dynaconf"}],"references":[{"url":"https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35p","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web","evidence","article","report"]},{"url":"https://github.com/dynaconf/dynaconf/commit/2fbb45ee36b8c0caa5b924fe19f3c1a5e8603fa7","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://github.com/dynaconf/dynaconf/releases/tag/3.2.13","tags":["x_refsource_MISC","Release Notes","web","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33154","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pxrr-hq57-q35p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33154.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-33154","tags":["advisory"]},{"url":"https://github.com/dynaconf/dynaconf","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34160","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482734","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487949","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461147","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466684","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34160.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6322","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33154","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33154","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41240","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41240","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41240","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/commit/c361baa18dbdcb3344a41110f4c48ad85bf48f80","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.4.0","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-h7mw-gpvr-xq4m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42035","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42035","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42035","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42784","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464122","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42784","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44293","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44293","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44293","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44431","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44431","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44431","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44432","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44432","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44432","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44488","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44488","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44488","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44495","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44495","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44495","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48526","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48526","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48526","tags":["advisory"]},{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74503","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50183","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50184","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50185","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50187","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50584","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50904","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74503.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488952","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12405","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12405","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488956","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12423","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12423","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12540","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489969","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12540","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12541","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489970","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12541","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12541","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12542","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489971","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12542","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12542","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12544","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489992","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12544","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12545","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489993","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12545","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12545","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://go.dev/cl/814980","tags":["article"]},{"url":"https://go.dev/issue/80405","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5972","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484204","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","tags":["advisory"]},{"url":"https://go.dev/cl/774481","tags":["article"]},{"url":"https://go.dev/issue/79217","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45623","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507595","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45623","tags":["advisory"]},{"url":"https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517527","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54284","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/939b129e24c0ad5d51368b1aa72fffcaca76f06f","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-pwgv-4x5q-6m9f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56097","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490543","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56097","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56098","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490542","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56098","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://go.dev/cl/807100","tags":["article"]},{"url":"https://go.dev/issue/80435","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6091","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://go.dev/cl/803681","tags":["article"]},{"url":"https://go.dev/issue/80494","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://go.dev/cl/804261","tags":["article"]},{"url":"https://go.dev/issue/80528","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6090","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59879","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59879","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59879","tags":["advisory"]},{"url":"https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84","tags":["article"]},{"url":"https://github.com/immutable-js/immutable-js/commit/f0bc997d8eb9886aff2236635aa210a95a04304a","tags":["article"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v4.3.9","tags":["article"]},{"url":"https://github.com/immutable-js/immutable-js/releases/tag/v5.1.8","tags":["article"]},{"url":"https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59893","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517523","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59893","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59893","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71491","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517518","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71491","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/ef2012a5eeb491e604dea2b00d516904a3830c87","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73086","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2514175","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73086","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3","tags":["article"]},{"url":"https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/3.3.12","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.1.11","tags":["article"]},{"url":"https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75899","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521778","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75899","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75931","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521777","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75931","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75975","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2521779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75975","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75975","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78679","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523205","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78679","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-79654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523348","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79654","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79654","tags":["advisory"]},{"url":"https://github.com/Katello/katello/pull/11847","tags":["article"]},{"url":"https://projects.theforeman.org/issues/39701","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84292","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527747","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84292","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-84394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527756","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84394","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84394","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87817","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530744","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87817","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96658","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2534185","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96658","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96658","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96659","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536844","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96659","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74504","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467800","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467802","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515827","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-50952","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50953","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74504.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42215","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42215","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42284","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42284","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://go.dev/cl/795540","tags":["article"]},{"url":"https://go.dev/issue/80205","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6089","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74505","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515243","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515269","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515272","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520368","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-50544","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50545","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74505.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-49825","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49825","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49825","tags":["advisory"]},{"url":"https://github.com/fedora-python/lxml_html_clean/commit/322357ac61c6cf80fcbaba53b4e92e31f3ded9f2","tags":["article"]},{"url":"https://github.com/fedora-python/lxml_html_clean/releases/tag/0.4.5","tags":["article"]},{"url":"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f","tags":["article"]},{"url":"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0","tags":["article"]},{"url":"https://github.com/lxml/lxml/releases/tag/lxml-6.1.1","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73620","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73620","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73620","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73622","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73622","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73622","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73623","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73623","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-template","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73624","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73624","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73624","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-diff","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73625","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73625","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73625","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smuggling","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74506","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74506.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-33154","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8231-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33154","tags":["web"]},{"url":"https://bugzilla.suse.com/1260063","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-33154","title":"dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver","description":"dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13.","status":"published","published":"2026-03-20T20:22:59.09Z","modified":"2026-03-27T15:23:09.972Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1336","CWE-94"],"updated_at":"2026-11-02T14:20:08.009733Z"}],"euvd":[{"id":"EUVD-2026-13790","description":"dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13.","status":"published","published":"2026-03-20T20:22:59Z","modified":"2026-03-27T15:23:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:25:27.277964Z"}],"ghsa":[{"id":"GHSA-pxrr-hq57-q35p","title":"dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver","description":"### Summary\nDynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @jinja resolver.\nWhen the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment.\n\nIf an attacker can influence configuration sources such as:\nenvironment variables\n.env files\ncontainer environment configuration\nCI/CD secrets\nthey can execute arbitrary OS commands on the host system.\nIn addition, the @format resolver allows object graph traversal, which may expose sensitive runtime objects and environment variables.\n\n### Details\nThe vulnerability arises because Dynaconf's string resolvers lack proper security boundaries.\n\n1. @jinja Resolver\nThe @jinja resolver renders templates using full Jinja2 evaluation.\nHowever, the rendering context is not sandboxed, which allows attackers to access Python's internal attributes.\nUsing objects such as cycler, attackers can reach Python's __globals__ and import the os module.\n\nExample attack path\ncycler\n → __init__\n → __globals__\n → os\n → popen()\nThis leads to arbitrary command execution.\n\n2. @format Resolver\nThe @format resolver performs Python string formatting using internal objects.\nThis allows attackers to traverse Python's object graph and access sensitive runtime objects.\nExample traversal:\n{this.__class__.__init__.__globals__[os].environ}\nThis can expose\n- API keys\n- database credentials\n- internal service tokens\n- environment secrets\n\n### PoC\n```\nimport os\nfrom dynaconf import Dynaconf\n# Malicious configuration injection\nos.environ[\"DYNACONF_RCE\"] = \"@jinja {{ cycler.__init__.__globals__.os.popen('id').read() }}\"\nsettings = Dynaconf()\nprint(\"[!] Command Execution Result:\")\nprint(settings.RCE)\n```\n### Impact\nSuccessful exploitation allows attackers to:\n- Execute arbitrary OS commands on the host system\n- Access sensitive environment variables\n- Compromise application secrets\n- Fully compromise the running application process\nBecause configuration values may originate from CI/CD pipelines, container orchestration systems, or environment injection, this vulnerability can become remotely exploitable in real-world deployments.\n\n\n### Remediation / Mitigation (Examples)\n\n1. Use Jinja2 sandbox for template rendering\n```\nfrom jinja2.sandbox import SandboxedEnvironment\nenv = SandboxedEnvironment()\ntemplate = env.from_string(\"{{ config_value }}\")\nsafe_value = template.render(config_value=user_input)```\n```\n2. Restrict @format usage to trusted values\n```\nsafe_value = \"{name}\".format(name=trusted_name)\n```","status":"published","published":"2026-03-18T20:08:06Z","modified":"2026-04-14T21:59:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78","CWE-94","CWE-1336"],"updated_at":"2026-11-02T14:39:54.128054Z"}],"nvd":[{"id":"CVE-2026-33154","description":"dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13.","status":"published","published":"2026-03-20T21:17:15.74Z","modified":"2026-06-17T10:37:02.443Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-94","CWE-1336","CWE-78"],"updated_at":"2026-11-02T14:12:10.126802Z"}],"osv":[{"id":"CVE-2026-33154","title":"dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver","description":"dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13.","status":"published","published":"2026-03-20T20:22:59.09Z","modified":"2026-10-28T02:30:50.740923989Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1336","CWE-94"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"DEBIAN-CVE-2026-33154","description":"dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13.","status":"published","published":"2026-03-20T21:17:15.74Z","modified":"2026-10-01T03:03:03.759288007Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"GHSA-pxrr-hq57-q35p","title":"dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver","description":"### Summary\nDynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @jinja resolver.\nWhen the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment.\n\nIf an attacker can influence configuration sources such as:\nenvironment variables\n.env files\ncontainer environment configuration\nCI/CD secrets\nthey can execute arbitrary OS commands on the host system.\nIn addition, the @format resolver allows object graph traversal, which may expose sensitive runtime objects and environment variables.\n\n### Details\nThe vulnerability arises because Dynaconf's string resolvers lack proper security boundaries.\n\n1. @jinja Resolver\nThe @jinja resolver renders templates using full Jinja2 evaluation.\nHowever, the rendering context is not sandboxed, which allows attackers to access Python's internal attributes.\nUsing objects such as cycler, attackers can reach Python's __globals__ and import the os module.\n\nExample attack path\ncycler\n → __init__\n → __globals__\n → os\n → popen()\nThis leads to arbitrary command execution.\n\n2. @format Resolver\nThe @format resolver performs Python string formatting using internal objects.\nThis allows attackers to traverse Python's object graph and access sensitive runtime objects.\nExample traversal:\n{this.__class__.__init__.__globals__[os].environ}\nThis can expose\n- API keys\n- database credentials\n- internal service tokens\n- environment secrets\n\n### PoC\n```\nimport os\nfrom dynaconf import Dynaconf\n# Malicious configuration injection\nos.environ[\"DYNACONF_RCE\"] = \"@jinja {{ cycler.__init__.__globals__.os.popen('id').read() }}\"\nsettings = Dynaconf()\nprint(\"[!] Command Execution Result:\")\nprint(settings.RCE)\n```\n### Impact\nSuccessful exploitation allows attackers to:\n- Execute arbitrary OS commands on the host system\n- Access sensitive environment variables\n- Compromise application secrets\n- Fully compromise the running application process\nBecause configuration values may originate from CI/CD pipelines, container orchestration systems, or environment injection, this vulnerability can become remotely exploitable in real-world deployments.\n\n\n### Remediation / Mitigation (Examples)\n\n1. Use Jinja2 sandbox for template rendering\n```\nfrom jinja2.sandbox import SandboxedEnvironment\nenv = SandboxedEnvironment()\ntemplate = env.from_string(\"{{ config_value }}\")\nsafe_value = template.render(config_value=user_input)```\n```\n2. Restrict @format usage to trusted values\n```\nsafe_value = \"{name}\".format(name=trusted_name)\n```","status":"published","published":"2026-03-18T20:08:06Z","modified":"2026-09-10T03:50:40.609033441Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1336","CWE-78","CWE-94"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"PYSEC-2026-2147","description":"dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13.","status":"published","published":"2026-03-20T21:17:15.74Z","modified":"2026-07-13T07:15:24.179518775Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"RHSA-2026:34160","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2026-07-02T10:17:34Z","modified":"2026-10-20T10:31:02.583742233Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:74503","title":"Red Hat Security Advisory: Satellite 6.19.5 Async Update","status":"published","published":"2026-10-02T10:25:57Z","modified":"2026-10-20T10:15:35Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74504","title":"Red Hat Security Advisory: Satellite 6.18.10 Async Update","status":"published","published":"2026-10-02T10:25:58Z","modified":"2026-10-20T10:15:36Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74505","title":"Red Hat Security Advisory: Satellite 6.17.12 Async Update","status":"published","published":"2026-10-03T10:16:56Z","modified":"2026-10-20T10:15:36Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74506","title":"Red Hat Security Advisory: Satellite 6.16.14 Async Update","status":"published","published":"2026-10-02T10:25:58Z","modified":"2026-10-20T10:15:37Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"UBUNTU-CVE-2026-33154","description":"dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates template expressions embedded in configuration values without a sandboxed environment. This issue has been patched in version 3.2.13.","status":"published","published":"2026-03-20T21:17:00Z","modified":"2026-10-17T12:58:10.44500127Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"openSUSE-SU-2026:10411-1","title":"python311-dynaconf-3.2.13-1.1 on GA media","description":"These are all security issues fixed in the python311-dynaconf-3.2.13-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-23T00:00:00Z","modified":"2026-03-24T08:45:06.950323Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20429-1","title":"Security update for python-dynaconf","description":"This update for python-dynaconf fixes the following issues:\n\nChanges in python-dynaconf:\n\n- CVE-2026-33154: Server-Side Template Injection in the @Jinja resolver (bsc#1260063)\n","status":"published","published":"2026-03-25T14:59:11Z","modified":"2026-03-29T17:25:24.876299Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"USN-8231-1","title":"python-dynaconf vulnerability","description":"It was discovered that Dynaconf was incorrectly handling template evaluation\nin its string resolvers. A remote attacker could possibly use this issue\nto execute arbitrary code.","status":"published","published":"2026-05-06T09:06:00Z","modified":"2026-05-07T14:14:21.435406879Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}