Description
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse the content of an included Markdown file as Jinja2 template code in a non-sandboxed environment, allowing server-side template injection that can lead to arbitrary code execution. The MDSectionInclude and MDCleanInclude tags in Trestle/core/jinja/tags.py pass included file content to Parser(self.environment, ...).parse(), splicing it into the host template's compilation, and the environment is a plain jinja2.Environment rather than a SandboxedEnvironment, so any expressions in the file are evaluated with full access to the usual SSTI gadget chain. Because Trestle's Markdown writers emit OSCAL prose and component-description fields verbatim, applying delimiter neutralization only to parameter tables, attacker-controlled OSCAL data such as a control statement, part prose, or component description containing Jinja2 syntax flows into an included Markdown file and is executed when the include tag re-parses it. This issue is fixed in version 4.1.0.
Published: 2026-08-25
Score: 7.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability is a server-side template injection in the Compliance-Trestle SDK that occurs when the custom Jinja2 tags mdsection_include or md_clean_include re-parse a markdown file as a template. Because the environment used is a standard Jinja2 Environment rather than a SandboxedEnvironment, the template is compiled and executed with full privileges. An attacker who can supply arbitrary content for an OSCAL control statement or component description, which is then written into a markdown file by Trestle, can embed Jinja2 syntax that will be evaluated, resulting in arbitrary code execution on the system running Trestle.

Affected Systems

The affected product is Compliance-Trestle, a Python SDK and command-line tool for OSCAL compliance documents developed by oscal-compass. Versions earlier than 3.12.4 and 4.0.0 through 4.0.3 contain the vulnerable custom Jinja2 tags. The issue is resolved in 4.1.0. No other versions are currently identified as vulnerable.

Risk and Exploitability

Based on the description, the vulnerability can be exploited when an attacker can supply or influence an OSCAL control statement, part prose, or component description that is then processed by Trestle. This typically requires local access or integration into a system that accepts user-supplied OSCAL data, making it a moderate to high risk vulnerability with a CVSS score of 7.8 and no available EPSS data. It is not yet listed in CISA’s Known Exploited Vulnerabilities catalog.

Generated by OpenCVE AI on August 26, 2026 at 01:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Compliance-Trestle to version 4.1.0 or later, which removes the unsafe Jinja2 include tags.
  • If an upgrade is not feasible, apply the security patches from the commit references that replace the environment with a sandboxed Jinja2 environment for the include tags.
  • Limit or sanitize OSCAL input data and isolate the Trestle process from untrusted sources to prevent accidental injection of Jinja2 syntax.

Generated by OpenCVE AI on August 26, 2026 at 01:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Oscal-compass
Oscal-compass compliance-trestle
Vendors & Products Oscal-compass
Oscal-compass compliance-trestle

Tue, 25 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Description Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse the content of an included Markdown file as Jinja2 template code in a non-sandboxed environment, allowing server-side template injection that can lead to arbitrary code execution. The MDSectionInclude and MDCleanInclude tags in Trestle/core/jinja/tags.py pass included file content to Parser(self.environment, ...).parse(), splicing it into the host template's compilation, and the environment is a plain jinja2.Environment rather than a SandboxedEnvironment, so any expressions in the file are evaluated with full access to the usual SSTI gadget chain. Because Trestle's Markdown writers emit OSCAL prose and component-description fields verbatim, applying delimiter neutralization only to parameter tables, attacker-controlled OSCAL data such as a control statement, part prose, or component description containing Jinja2 syntax flows into an included Markdown file and is executed when the include tag re-parses it. This issue is fixed in version 4.1.0.
Title Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
Weaknesses CWE-1336
CWE-94
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oscal-compass Compliance-trestle
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-25T23:18:29.487Z

Reserved: 2026-06-24T01:47:55.285Z

Link: CVE-2026-57170

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T02:30:04Z

Weaknesses
  • CWE-1336

    Improper Neutralization of Special Elements Used in a Template Engine

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')