The vulnerability resides in the HTTPSFetcher._do_fetch() method of compliance-trestle. Prior to software versions 3.12.2 and 4.0.3, the implementation forwards a user‑supplied URL directly to the requests.get() function without any validation or sanitation. This allows a malicious actor to instruct the server to visit an arbitrary URL, including internal network services or cloud metadata endpoints, thereby exposing sensitive data or enabling further internal attacks. The weakness is a classic Server‑Side Request Forgery described by CWE‑918.

The affected product is OSCal‑Compass compliance‑trestle, used for managing compliance as code. Any deployment using a version earlier than 3.12.2 or 4.0.3 remains vulnerable. Versions 3.12.2 and 4.0.3 contain the patch that validates the URL before fetching.

The CVSS score of 6.7 indicates a medium severity impact with potential confidentiality and integrity implications. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Exploitation requires control over the configuration or input that entrusts a URL to the fetcher—typically through APIs or user interfaces that accept remote resource definitions. If an attacker can provide a crafted URL, they may reach internal services or metadata endpoints accessible only within the network, potentially exposing credentials, system identifiers, or other sensitive information.