A server‑side template injection flaw allows an attacker to inject malicious Jinja2 expressions that are re‑evaluated by Trestle’s non‑sandboxed Jinja2 environment. The vulnerability exists in MDCleanInclude and MDSectionInclude tags when processing untrusted Markdown or YAML content. The injected code can traverse Python object internals and execute arbitrary operating system commands within the Trestle process, leading to full remote code execution on the host system.

The vulnerability affects Compliance‑Trestle (Trestle), a Python SDK and CLI for OSCAL compliance, provided by OSCAL Compass. Versions before 3.12.4 and versions 4.0.0 through 4.0.3 are impacted; the issue is resolved in 3.12.4 and 4.1.0.

The published CVSS score is 7.8, indicating a high-severity flaw. The EPSS score of <1% shows a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread documented exploitation yet. Attackers with control over content that Trestle renders — such as crafted workspace Markdown, third‑party SSP documents, or YAML lookup tables — can exploit the flaw by injecting Jinja2 expressions that access internal object attributes and invoke system commands. The vulnerability can be triggered remotely by supplying malicious content that Trestle processes.