CVE-2026-54757
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the MDCleanInclude and MDSectionInclude Jinja2 tags re-parse untrusted Markdown content as template source code using a non-sandboxed jinja2.Environment. An attacker who controls content that Trestle renders, such as a crafted workspace Markdown file, a third-party SSP document, or a YAML lookup-table value, can inject a Jinja2 expression that traverses Python object internals to execute arbitrary operating system commands in the context of the Trestle process. This issue is fixed in versions 3.12.4 and 4.1.0.
Risk Assessment
The risk to the organization includes remote code execution in the context of the Trestle process, which could lead to system compromise, manipulation of compliance documents, or data theft. The vulnerability can be exploited by an attacker controlling content processed by Trestle.
Recommendation
It is recommended to immediately update Trestle to version 3.12.4 or 4.1.0. Also avoid processing untrusted Markdown or YAML files and restrict access to the tool.
Other vulnerabilities in Compliance-trestle
See all- CVE-2026-46439High
compliance-trestle before versions 3.12.2 and 4.0.3 has a Server-Side Template Injection (SSTI) vulnerability in the 'trestle author jinja' command. Recursive template processing allows an attacker to execute arbitrary commands by injecting malicious data into data fields.
- CVE-2026-57171High
Compliance-trestle (Trestle) before version 3.12.4 and versions 4.0.0 through 4.0.3 allows arbitrary file write outside the Trestle workspace via an attacker-influenced output path without path-traversal validation. This can lead to file overwrite, and with --force-overwrite to directory deletion and indirect code execution.
- CVE-2026-57170High
Compliance-trestle (Trestle) before version 3.12.4 and versions 4.0.0 through 4.0.3 contains a server-side template injection (SSTI) vulnerability in the custom Jinja2 include tags mdsection_include and md_clean_include, which can lead to arbitrary code execution. Attacker-controlled OSCAL data can be executed as template code.
- CVE-2026-52776High
Compliance-trestle (Trestle) before version 3.12.4 and versions 4.0.0 through 4.0.3 has a vulnerability in the URLSecurityValidator that guards remote-fetch paths against SSRF. It can be bypassed to reach loopback, link-local, cloud-metadata, and internal network endpoints. Fixed in versions 3.12.4 and 4.1.0.
- CVE-2026-46345High
compliance-trestle before versions 3.12.2 and 4.0.3 has a vulnerability in the `-o/--output` argument in `trestle author jinja` that allows writing files outside the intended workspace. The application does not properly validate `../`, `..\`, or absolute paths, allowing arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue.
- CVE-2026-46380Medium
compliance-trestle before versions 3.12.2 and 4.0.3 contains a vulnerability in the HTTPSFetcher._do_fetch() method that passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints.
- CVE-2026-45774Medium
compliance-trestle before versions 3.12.2 and 4.0.3 contains a vulnerability in the profile import mechanism that allows reading arbitrary files from the server filesystem. The mechanism joins `trestle://` URIs and relative paths with `trestle_root` without boundary checks, enabling an attacker to use path traversal sequences in `imports[].href` in a malicious OSCAL profile.
- CVE-2026-45725High
compliance-trestle before versions 3.12.2 and 4.0.3 has a vulnerability in the remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) where the local cache file path is constructed from the URL path component without sanitizing path traversal sequences (../). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location outside the intended cache directory, enabling arbitrary file write with attacker-controlled content to the filesystem. Versions 3.12.3 and 4.0.3 patch the issue.
Original NVD description (English source)
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the MDCleanInclude and MDSectionInclude Jinja2 tags re-parse untrusted Markdown content as template source code using a non-sandboxed jinja2.Environment. An attacker who controls content that Trestle renders, such as a crafted workspace Markdown file, a third-party SSP document, or a YAML lookup-table value, can inject a Jinja2 expression that traverses Python object internals to execute arbitrary operating system commands in the context of the Trestle process. This issue is fixed in versions 3.12.4 and 4.1.0.