Vulnerabilities

Filters

1 selected

9 records

Sort

Vendor: oscal-compass Clear all filters

TI-2026-41138 CVE-2026-57171 · GHSA-r4vp-3vw6-r2x5

Path traversal in oscal-compass compliance-trestle

LOW 33

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents.

CVSS 3.1HIGH 7.7 Local No auth No interaction EPSS 0.00221 Published 2026-08-25 Fixed in 3.12.4, 4.1.0 CWE-22

TI-2026-41137 CVE-2026-57170 · GHSA-mr95-65j8-9mxp

Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

LOW 36

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00235 Published 2026-08-25 Fixed in 3.12.4, 4.1.0 CWE-1336

TI-2026-37891 CVE-2026-52776 · GHSA-h47f-gmjp-m7rr

Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

HIGH 72

Compliance-trestle (Trestle) is a tooling platform for managing compliance as code.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00439 Published 2026-08-25 Fixed in 3.12.4, 4.1.0 CWE-184

TI-2026-39563 CVE-2026-54757 · GHSA-jw39-3688-r4rx

Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

LOW 36

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00364 Published 2026-08-25 Fixed in 3.12.4, 4.1.0 CWE-94

TI-2026-34065 CVE-2026-46345 · GHSA-4q5v-7g7x-j79w

compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

HIGH 72

compliance-trestle is a tooling platform for managing compliance as code.

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.00204 Published 2026-08-17 Fixed in 4.0.3, 3.12.2 CWE-22

TI-2026-34095 CVE-2026-46380 · GHSA-w76h-q7c6-jpjp

compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

MEDIUM 63

compliance-trestle is a tooling platform for managing compliance as code.

CVSS 3.1MEDIUM 6.7 Local Low privileges User interaction EPSS 0.00142 Published 2026-08-14 Partial fix · 4.0.3, 3.12.2 CWE-918

TI-2026-34145 CVE-2026-46439 · GHSA-gg2g-p7xc-qqmm

compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)

HIGH 69

compliance-trestle is a tooling platform for managing compliance as code.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00268 Published 2026-08-14 Fixed in 3.12.2, 4.0.3 CWE-1336

TI-2026-33511 CVE-2026-45774 · GHSA-mj4x-vf5c-5xg8

compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal

MEDIUM 64

compliance-trestle is a tooling platform for managing compliance as code.

CVSS 4.0MEDIUM 6.9 Network No auth User interaction EPSS 0.00544 Published 2026-08-13 Fixed in 3.12.2, 4.0.3 CWE-22

TI-2026-33463 CVE-2026-45725 · GHSA-g3vg-vx23-3858

compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal

LOW 32

compliance-trestle is a tooling platform for managing compliance as code.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00466 Published 2026-08-13 Fixed in 3.12.2, 4.0.3 CWE-73