Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.
Summary
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse the content of an included Markdown file as Jinja2 template code in a non-sandboxed environment, allowing server-side template injection that can lead to arbitrary code execution. The MDSectionInclude and MDCleanInclude tags in Trestle/core/jinja/tags.py pass included file content to Parser(self.environment, ...).parse(), splicing it into the host template's compilation, and the environment is a plain jinja2.Environment rather than a SandboxedEnvironment, so any expressions in the file are evaluated with full access to the usual SSTI gadget chain. Because Trestle's Markdown writers emit OSCAL prose and component-description fields verbatim, applying delimiter neutralization only to parameter tables, attacker-controlled OSCAL data such as a control statement, part prose, or component description containing Jinja2 syntax flows into an included Markdown file and is executed when the include tag re-parses it. This issue is fixed in version 4.1.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| oscal-compass | compliance-trestle | before 3.12.4; 4.0.0 to before 4.1.0 | 3.12.4, 4.1.0 | Patch available | CNA |
| — | compliance-trestle (PyPI) | before 3.12.4 | 3.12.4 | Patch available | GHSA-mr95-65j8-9mxp |
| — | compliance-trestle (PyPI) | 4.0.0 to before 4.1.0 | 4.1.0 | Patch available | GHSA-mr95-65j8-9mxp |
- compliance-trestle Vendoroscal-compass Affected before 3.12.4; 4.0.0 to before 4.1.0 Fixed in 3.12.4, 4.1.0 Patch available CNA
- compliance-trestle (PyPI) Vendor— Affected before 3.12.4 Fixed in 3.12.4 Patch available GHSA-mr95-65j8-9mxp
- compliance-trestle (PyPI) Vendor— Affected 4.0.0 to before 4.1.0 Fixed in 4.1.0 Patch available GHSA-mr95-65j8-9mxp
Remediation
- Fix · CNA compliance-trestle (oscal-compass) Fixed in 3.12.4, 4.1.0
- Fix · GHSA-mr95-65j8-9mxp compliance-trestle (PyPI) Fixed in 3.12.4 Advisory →
- Fix · GHSA-mr95-65j8-9mxp compliance-trestle (PyPI) Fixed in 4.1.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 2 products
- File Integrity Operator
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2026-57170
- 2026-10-03 Alias added: GHSA-mr95-65j8-9mxp
- 2026-10-10 Affected versions changed · Red Hat
References
Other 7
- https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-mr95-65j8-9mxp
- https://github.com/oscal-compass/compliance-trestle/commit/0f82d19bd42f9cc0f1b3acd7fc3f6dafe3b6ae10
- https://github.com/oscal-compass/compliance-trestle/commit/5335ff873a2a68eb7de43df029bea09cadff22fd
- https://github.com/oscal-compass/compliance-trestle/pull/2270
- https://github.com/oscal-compass/compliance-trestle
- https://github.com/oscal-compass/compliance-trestle/releases/tag/v3.12.4
- https://github.com/oscal-compass/compliance-trestle/releases/tag/v4.1.0
More oscal-compass vulnerabilities
- TI-2026-37891 Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0 CVSS 4.0HIGH 8.6
- TI-2026-34065 compliance-trestle - jinja has an Arbitrary File Write via Path Traversal CVSS 3.1HIGH 8.4
- TI-2026-34145 compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI) CVSS 3.1HIGH 7.8
- TI-2026-33511 compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal CVSS 4.0MEDIUM 6.9
- TI-2026-34095 compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem CVSS 3.1MEDIUM 6.7
- TI-2026-39563 Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data CVSS 3.1HIGH 7.8
Sources
- CVE-2026-57170 · CVE Program
- CVE-2026-57170 · NVD
- FIRST EPSS
- GHSA-mr95-65j8-9mxp · GitHub Advisory Database · CC BY 4.0
- CVE-2026-57170 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences