compliance-trestle CVE-2026-54757

Exploitation requires that a user run compliance-trestle against content containing injected Jinja2 expressions - specifically, content that passes through the MDCleanInclude or MDSectionInclude tag rendering pipeline. The three documented attacker-controlled input surfaces are: (1) a crafted workspace Markdown file (e.g., a system security plan section authored or modified by the attacker), (2) a third-party SSP document imported into a Trestle workspace, or (3) a YAML lookup-table value used during template rendering. The attacker does not need authenticated access to the target system - they only need their malicious content to be present in a workspace that a legitimate user processes. Exploitation is bounded by the requirement for user interaction (a human must invoke a Trestle command), and by the local attack vector (the malicious file must exist on the processing host before Trestle runs). Non-default configuration or network access is not required once the malicious content is in the workspace. Impact is scoped to the privileges of the Trestle process user - no privilege escalation or scope change is implied.

The CVSS 7.8 score with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a realistic local-vector RCE: the attacker does not need system privileges but must get malicious content into a workspace that a user then processes with Trestle. The UI:R metric is the primary limiting factor - exploitation requires a human to invoke Trestle against the malicious input, which aligns with the described attack surfaces (imported SSP documents, third-party YAML lookup tables). No EPSS score was provided in the input data, so probabilistic exploitation risk cannot be quantified. There is no CISA KEV listing, and no standalone POC tool has been identified, though the security test suite committed alongside the fix demonstrates a working proof-of-concept payload pattern. The combination of AV:L and UI:R meaningfully limits opportunistic exploitation; however, supply-chain scenarios - where a compliance team imports a crafted third-party OSCAL document as part of routine workflow - represent a credible targeted attack path. The C:H/I:H/A:H impact metrics are appropriate given full OS command execution in the Trestle process context.

An attacker embeds a Jinja2 RCE payload such as {{ ''.__class__.__mro__[1].__subclasses__()[X]('id',shell=True) }} inside a crafted OSCAL SSP Markdown file or YAML lookup-table value and distributes it as a third-party compliance artifact. A compliance engineer imports the document into a Trestle workspace and runs a standard trestle task or author command, triggering MDCleanInclude or MDSectionInclude to re-parse the Markdown through a non-sandboxed Jinja2 environment, executing the injected OS command as the engineer's local user. No public exploit tool has been identified, but the attack pattern is well-understood and the security test suite committed with the fix demonstrates the exact payload structure.