CVE-2026-57170 in compliance-trestle
Summary
by MITRE • 08/26/2026
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse the content of an included Markdown file as Jinja2 template code in a non-sandboxed environment, allowing server-side template injection that can lead to arbitrary code execution. The MDSectionInclude and MDCleanInclude tags in Trestle/core/jinja/tags.py pass included file content to Parser(self.environment, ...).parse(), splicing it into the host template's compilation, and the environment is a plain jinja2.Environment rather than a SandboxedEnvironment, so any expressions in the file are evaluated with full access to the usual SSTI gadget chain. Because Trestle's Markdown writers emit OSCAL prose and component-description fields verbatim, applying delimiter neutralization only to parameter tables, attacker-controlled OSCAL data such as a control statement, part prose, or component description containing Jinja2 syntax flows into an included Markdown file and is executed when the include tag re-parses it. This issue is fixed in version 4.1.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in Compliance-trestle affects versions prior to 3.12.4 and those within the range of 4.0.0 through 4.0.3, representing a critical server-side template injection flaw rooted in improper handling of dynamic content during document processing. Trestle serves as a Python SDK and command-line interface for managing Open Security Controls Assessment Language compliance documents, relying heavily on Jinja2 templates to render Markdown output from structured OSCAL data. The core technical defect lies within the custom Jinja2 include tags named mdsection_include and md_clean_include, which are implemented in the Trestle/core/jinja/tags.py module. When these tags process an included Markdown file, they extract its content and pass it directly to a Parser instance initialized with a standard jinja2.Environment object for re-parsing as template code. This architectural decision fails to isolate the execution context of the injected content from the host application environment.
The severity of this vulnerability is amplified by the fact that the Jinja2 environment used for parsing is not configured as a SandboxedEnvironment. In secure implementations, sandboxed environments restrict access to dangerous attributes and methods within Python objects, thereby neutralizing many common server-side template injection attack vectors. By utilizing a plain Environment object, Trestle inadvertently grants any evaluated expressions full access to the underlying Python runtime capabilities. This configuration allows an attacker who can inject Jinja2 syntax into processed documents to exploit standard gadget chains associated with SSTI vulnerabilities, ultimately leading to arbitrary code execution on the host system where the tool is running.
The attack vector exploits the way Trestle handles OSCAL data during its Markdown writing phase. The software emits OSCAL prose and component-description fields verbatim without sufficient sanitization of template delimiters across all field types. While some parameter tables may undergo delimiter neutralization, other critical sections such as control statements, part pro se, or component descriptions do not receive the same level of protection against injection. Consequently, if an attacker controls any OSCAL data containing Jinja2 syntax within these unsanitized fields, that malicious content flows into included Markdown files during template rendering. When the include tag subsequently re-parses this file as a new template, the injected expressions are executed with the privileges of the user running Trestle.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code or Script, specifically Server-Side Template Injection. It also maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, as it enables remote code execution through template injection rather than direct command input. The operational impact is severe, potentially allowing full compromise of the system executing Trestle commands if an attacker can influence the content of compliance documents processed by the tool. This risk is particularly pertinent in environments where OSCAL files are generated or modified by multiple users with varying levels of trustworthiness.
The issue has been addressed and fixed in version 4.1.0 of Compliance-trestle. Organizations utilizing this software should upgrade to the patched version immediately to mitigate the risk of arbitrary code execution via template injection. Until upgrading is possible, administrators should enforce strict validation on all OSCAL inputs and avoid using custom include tags with untrusted data sources. Additionally, implementing input sanitization that neutralizes Jinja2 delimiters in all relevant fields, not just parameter tables, would provide a defensive layer against similar exploitation attempts in legacy versions where patching may be delayed due to operational constraints.