Compliance-Trestle CVE-2026-57170

Exploitation requires three concurrent conditions: (1) the target is running compliance-trestle in an affected version (prior to 3.12.4, or 4.0.0 through 4.0.3); (2) a Jinja2 template in the rendering workflow uses the mdsection_include or md_clean_include custom include tags - templates that do not use these tags are not vulnerable; and (3) an attacker can influence the content of an OSCAL prose field - specifically control statements, part prose, or component description fields - that is written verbatim into a Markdown file included by those tags. OSCAL parameter table fields are explicitly NOT vulnerable because Trestle applies delimiter neutralization to them. The CVSS vector (PR:L, AV:L) indicates that the attacker requires low-privilege local access or the ability to supply malicious OSCAL source data to the rendering pipeline; they do not need OS-level privileges but do need write access to the OSCAL content consumed by trestle. Default installations processing only fully internal, trusted OSCAL content are not exposed without an insider or supply-chain threat vector.

The CVSS 3.1 score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the attack surface: exploitation requires local access and low-privilege control over OSCAL input data, not remote unauthenticated reach. EPSS data is absent from the provided intelligence, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in the CISA KEV catalog, and no standalone public exploit code has been identified - only security test payloads in the upstream fix commit, which confirms the mechanism but does not constitute weaponized tooling. The combination of high CIA impact (H/H/H) and low exploitation complexity (AC:L, PR:L) makes this a genuine priority for any organization running compliance automation pipelines that ingest third-party or community-contributed OSCAL content; the local attack vector limits opportunistic mass exploitation but does not reduce risk in supply-chain or shared-repository scenarios where OSCAL catalogs or component definitions are sourced from external contributors. Organizations should treat the severity as operationally higher than the local vector might suggest when external OSCAL data is in scope.

An attacker with write access to a shared OSCAL component definition repository (for example, via a pull request or a compromised upstream catalog) embeds Jinja2 template syntax such as {{ ''.__class__.__mro__[1].__subclasses__()[N]('id',shell=True,stdout=-1).communicate()[0] }} in a component description field. When an operator on an affected Trestle version runs a template rendering command that uses mdsection_include or md_clean_include on a Markdown file derived from that OSCAL data, the malicious expression is re-parsed in the unsandboxed Jinja2 environment and executes arbitrary shell commands with the privileges of the trestle process. Security test payloads demonstrating this exact gadget chain are present in the upstream fix commit.