EUVD-2026-66209
GHSA-jw39-3688-r4rx
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:L because malicious content must exist locally; PR:N as attacker needs no system privileges, only content delivery; UI:R because a user must invoke Trestle; full C/I/A impact from arbitrary OS command execution.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the MDCleanInclude and MDSectionInclude Jinja2 tags re-parse untrusted Markdown content as template source code using a non-sandboxed jinja2.Environment. An attacker who controls content that Trestle renders, such as a crafted workspace Markdown file, a third-party SSP document, or a YAML lookup-table value, can inject a Jinja2 expression that traverses Python object internals to execute arbitrary operating system commands in the context of the Trestle process. This issue is fixed in versions 3.12.4 and 4.1.0.
AnalysisAI
Server-side template injection in compliance-trestle's custom Jinja2 tags enables remote code execution when the tool processes attacker-controlled Markdown or YAML content. Versions before 3.12.4 and the 4.0.x series through 4.0.3 are affected; the root flaw is that MDCleanInclude and MDSectionInclude re-parse included content using a non-sandboxed jinja2.Environment, allowing injected expressions to traverse Python object internals and invoke arbitrary OS commands as the Trestle process user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a user run compliance-trestle against content containing injected Jinja2 expressions - specifically, content that passes through the MDCleanInclude or MDSectionInclude tag rendering pipeline. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a realistic local-vector RCE: the attacker does not need system privileges but must get malicious content into a workspace that a user then processes with Trestle. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade compliance-trestle to version 3.12.4 (for environments on the 3.x branch) or version 4.1.0 (for environments on the 4.x branch); these are the vendor-confirmed fixed releases referenced in the GitHub security advisory at https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-jw39-3688-r4rx and evidenced by commits 0f82d19bd42f9cc0f1b3acd7fc3f6dafe3b6ae10 and 5335ff873a2a68eb7de43df029bea09cadff22fd. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running compliance-trestle versions before 3.12.4 or in the 4.0.x series through 4.0.3, and isolate or disable external document import functionality that processes third-party compliance content. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today