oscal-compass compliance-trestle up to 3.12.3/4.0.3 MDCleanInclude/MDSectionInclude special elements in template engine

Summaryinfo

A vulnerability labeled as critical has been found in oscal-compass compliance-trestle up to 3.12.3/4.0.3. The impacted element is an unknown function of the component MDCleanInclude/MDSectionInclude. Such manipulation leads to special elements in template engine. This vulnerability is listed as CVE-2026-54757. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in oscal-compass compliance-trestle up to 3.12.3/4.0.3. It has been rated as critical. Affected by this issue is an unknown part of the component MDCleanInclude/MDSectionInclude. The manipulation with an unknown input leads to a special elements in template engine vulnerability. Using CWE to declare the problem leads to CWE-1336. The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the MDCleanInclude and MDSectionInclude Jinja2 tags re-parse untrusted Markdown content as template source code using a non-sandboxed jinja2.Environment. An attacker who controls content that Trestle renders, such as a crafted workspace Markdown file, a third-party SSP document, or a YAML lookup-table value, can inject a Jinja2 expression that traverses Python object internals to execute arbitrary operating system commands in the context of the Trestle process. This issue is fixed in versions 3.12.4 and 4.1.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-54757 since 06/16/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1221.

Upgrading to version 3.12.4 or 4.1.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• oscal-compass

Name

• compliance-trestle

Version

• 3.12.0
• 3.12.1
• 3.12.2
• 3.12.3
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3

Website

• Product: https://github.com/oscal-compass/compliance-trestle/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion