CVE-2026-57171
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Compliance-trestle (Trestle) before version 3.12.4 and versions 4.0.0 through 4.0.3 allows arbitrary file write outside the Trestle workspace via an attacker-influenced output path without path-traversal validation. This can lead to file overwrite, and with --force-overwrite to directory deletion and indirect code execution.
Risk Assessment
In CI environments or shared services where the output argument is derived from untrusted data, an attacker can overwrite or delete files, potentially leading to process or system compromise.
Recommendation
Upgrade Compliance-trestle to version 3.12.4 or 4.1.0 and ensure output arguments are validated and not derived from untrusted sources.
Other vulnerabilities in Compliance-trestle
See all- CVE-2026-46439High
compliance-trestle before versions 3.12.2 and 4.0.3 has a Server-Side Template Injection (SSTI) vulnerability in the 'trestle author jinja' command. Recursive template processing allows an attacker to execute arbitrary commands by injecting malicious data into data fields.
- CVE-2026-57170High
Compliance-trestle (Trestle) before version 3.12.4 and versions 4.0.0 through 4.0.3 contains a server-side template injection (SSTI) vulnerability in the custom Jinja2 include tags mdsection_include and md_clean_include, which can lead to arbitrary code execution. Attacker-controlled OSCAL data can be executed as template code.
- CVE-2026-52776High
Compliance-trestle (Trestle) before version 3.12.4 and versions 4.0.0 through 4.0.3 has a vulnerability in the URLSecurityValidator that guards remote-fetch paths against SSRF. It can be bypassed to reach loopback, link-local, cloud-metadata, and internal network endpoints. Fixed in versions 3.12.4 and 4.1.0.
- CVE-2026-54757High
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the MDCleanInclude and MDSectionInclude Jinja2 tags re-parse untrusted Markdown content as template source code using a non-sandboxed jinja2.Environment. An attacker who controls content that Trestle renders, such as a crafted workspace Markdown file, a third-party SSP document, or a YAML lookup-table value, can inject a Jinja2 expression that traverses Python object internals to execute arbitrary operating system commands in the context of the Trestle process. This issue is fixed in versions 3.12.4 and 4.1.0.
- CVE-2026-46345High
compliance-trestle before versions 3.12.2 and 4.0.3 has a vulnerability in the `-o/--output` argument in `trestle author jinja` that allows writing files outside the intended workspace. The application does not properly validate `../`, `..\`, or absolute paths, allowing arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue.
- CVE-2026-46380Medium
compliance-trestle before versions 3.12.2 and 4.0.3 contains a vulnerability in the HTTPSFetcher._do_fetch() method that passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints.
- CVE-2026-45774Medium
compliance-trestle before versions 3.12.2 and 4.0.3 contains a vulnerability in the profile import mechanism that allows reading arbitrary files from the server filesystem. The mechanism joins `trestle://` URIs and relative paths with `trestle_root` without boundary checks, enabling an attacker to use path traversal sequences in `imports[].href` in a malicious OSCAL profile.
- CVE-2026-45725High
compliance-trestle before versions 3.12.2 and 4.0.3 has a vulnerability in the remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) where the local cache file path is constructed from the URL path component without sanitizing path traversal sequences (../). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location outside the intended cache directory, enabling arbitrary file write with attacker-controlled content to the filesystem. Versions 3.12.3 and 4.0.3 patch the issue.
Original NVD description (English source)
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output path without path-traversal validation, allowing arbitrary file write outside the Trestle workspace. These commands join the user-supplied output argument onto the Trestle root and write to the result, but guard it only with an is_directory_name_allowed() task-name-collision check rather than the PathSecurityValidator.validate_local_path() guard used by the jinja command, so an absolute path or one containing traversal sequences escapes the workspace and writes files under an attacker-chosen location as the invoking process owner. The security boundary is crossed when a trusted CI job, shared service, or wrapper derives the output argument from repository-controlled, tenant-controlled, or otherwise untrusted data while expecting output to stay inside the workspace. When --force-overwrite is used, the selected output directory is first recursively deleted, extending the primitive to destruction of an attacker-chosen directory tree and enabling indirect code execution by overwriting files a pipeline later runs. This issue is fixed in versions 3.12.4 and 4.1.0.