CVE-2026-57170
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Compliance-trestle (Trestle) before version 3.12.4 and versions 4.0.0 through 4.0.3 contains a server-side template injection (SSTI) vulnerability in the custom Jinja2 include tags mdsection_include and md_clean_include, which can lead to arbitrary code execution. Attacker-controlled OSCAL data can be executed as template code.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary code in the context of the Trestle process, potentially leading to full system and data compromise.
Recommendation
Upgrade Compliance-trestle to version 4.1.0 and avoid processing untrusted OSCAL data in environments where include tags are used.
Other vulnerabilities in Compliance-trestle
See all- CVE-2026-46439High
compliance-trestle before versions 3.12.2 and 4.0.3 has a Server-Side Template Injection (SSTI) vulnerability in the 'trestle author jinja' command. Recursive template processing allows an attacker to execute arbitrary commands by injecting malicious data into data fields.
- CVE-2026-57171High
Compliance-trestle (Trestle) before version 3.12.4 and versions 4.0.0 through 4.0.3 allows arbitrary file write outside the Trestle workspace via an attacker-influenced output path without path-traversal validation. This can lead to file overwrite, and with --force-overwrite to directory deletion and indirect code execution.
- CVE-2026-52776High
Compliance-trestle (Trestle) before version 3.12.4 and versions 4.0.0 through 4.0.3 has a vulnerability in the URLSecurityValidator that guards remote-fetch paths against SSRF. It can be bypassed to reach loopback, link-local, cloud-metadata, and internal network endpoints. Fixed in versions 3.12.4 and 4.1.0.
- CVE-2026-54757High
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the MDCleanInclude and MDSectionInclude Jinja2 tags re-parse untrusted Markdown content as template source code using a non-sandboxed jinja2.Environment. An attacker who controls content that Trestle renders, such as a crafted workspace Markdown file, a third-party SSP document, or a YAML lookup-table value, can inject a Jinja2 expression that traverses Python object internals to execute arbitrary operating system commands in the context of the Trestle process. This issue is fixed in versions 3.12.4 and 4.1.0.
- CVE-2026-46345High
compliance-trestle before versions 3.12.2 and 4.0.3 has a vulnerability in the `-o/--output` argument in `trestle author jinja` that allows writing files outside the intended workspace. The application does not properly validate `../`, `..\`, or absolute paths, allowing arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue.
- CVE-2026-46380Medium
compliance-trestle before versions 3.12.2 and 4.0.3 contains a vulnerability in the HTTPSFetcher._do_fetch() method that passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints.
- CVE-2026-45774Medium
compliance-trestle before versions 3.12.2 and 4.0.3 contains a vulnerability in the profile import mechanism that allows reading arbitrary files from the server filesystem. The mechanism joins `trestle://` URIs and relative paths with `trestle_root` without boundary checks, enabling an attacker to use path traversal sequences in `imports[].href` in a malicious OSCAL profile.
- CVE-2026-45725High
compliance-trestle before versions 3.12.2 and 4.0.3 has a vulnerability in the remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) where the local cache file path is constructed from the URL path component without sanitizing path traversal sequences (../). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location outside the intended cache directory, enabling arbitrary file write with attacker-controlled content to the filesystem. Versions 3.12.3 and 4.0.3 patch the issue.
Original NVD description (English source)
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse the content of an included Markdown file as Jinja2 template code in a non-sandboxed environment, allowing server-side template injection that can lead to arbitrary code execution. The MDSectionInclude and MDCleanInclude tags in Trestle/core/jinja/tags.py pass included file content to Parser(self.environment, ...).parse(), splicing it into the host template's compilation, and the environment is a plain jinja2.Environment rather than a SandboxedEnvironment, so any expressions in the file are evaluated with full access to the usual SSTI gadget chain. Because Trestle's Markdown writers emit OSCAL prose and component-description fields verbatim, applying delimiter neutralization only to parameter tables, attacker-controlled OSCAL data such as a control statement, part prose, or component description containing Jinja2 syntax flows into an included Markdown file and is executed when the include tag re-parses it. This issue is fixed in version 4.1.0.