CVE-2026-46439

Compliance-trestle (Trestle) before version 3.12.4 and versions 4.0.0 through 4.0.3 allows arbitrary file write outside the Trestle workspace via an attacker-influenced output path without path-traversal validation. This can lead to file overwrite, and with --force-overwrite to directory deletion and indirect code execution.

Compliance-trestle (Trestle) before version 3.12.4 and versions 4.0.0 through 4.0.3 contains a server-side template injection (SSTI) vulnerability in the custom Jinja2 include tags mdsection_include and md_clean_include, which can lead to arbitrary code execution. Attacker-controlled OSCAL data can be executed as template code.

Compliance-trestle (Trestle) before version 3.12.4 and versions 4.0.0 through 4.0.3 has a vulnerability in the URLSecurityValidator that guards remote-fetch paths against SSRF. It can be bypassed to reach loopback, link-local, cloud-metadata, and internal network endpoints. Fixed in versions 3.12.4 and 4.1.0.

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the MDCleanInclude and MDSectionInclude Jinja2 tags re-parse untrusted Markdown content as template source code using a non-sandboxed jinja2.Environment. An attacker who controls content that Trestle renders, such as a crafted workspace Markdown file, a third-party SSP document, or a YAML lookup-table value, can inject a Jinja2 expression that traverses Python object internals to execute arbitrary operating system commands in the context of the Trestle process. This issue is fixed in versions 3.12.4 and 4.1.0.

compliance-trestle before versions 3.12.2 and 4.0.3 has a vulnerability in the `-o/--output` argument in `trestle author jinja` that allows writing files outside the intended workspace. The application does not properly validate `../`, `..\`, or absolute paths, allowing arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue.

compliance-trestle before versions 3.12.2 and 4.0.3 contains a vulnerability in the HTTPSFetcher._do_fetch() method that passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints.

compliance-trestle before versions 3.12.2 and 4.0.3 contains a vulnerability in the profile import mechanism that allows reading arbitrary files from the server filesystem. The mechanism joins `trestle://` URIs and relative paths with `trestle_root` without boundary checks, enabling an attacker to use path traversal sequences in `imports[].href` in a malicious OSCAL profile.

compliance-trestle before versions 3.12.2 and 4.0.3 has a vulnerability in the remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) where the local cache file path is constructed from the URL path component without sanitizing path traversal sequences (../). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location outside the intended cache directory, enabling arbitrary file write with attacker-controlled content to the filesystem. Versions 3.12.3 and 4.0.3 patch the issue.