Administrator-level code execution via unvalidated configuration keys

Code injection in Flowintel 3.3.0 and earlier allows remote authenticated users with administrator access to execute Python code. The alerts settings update endpoint inserts requester-controlled keys into assignment lines in conf/config_module.py and reloads that module without restricting key names. An administrator-level account is required; successful exploitation runs statements with the Flowintel server process's privileges and can read, alter, or interrupt application data and services.