compliance-trestle CVE-2026-57171
HIGHSeverity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Local execution of the trestle CLI with no privileges required; no confidentiality impact; integrity and availability both high due to arbitrary write and destructive overwrite with --force-overwrite.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output path without path-traversal validation, allowing arbitrary file write outside the Trestle workspace. These commands join the user-supplied output argument onto the Trestle root and write to the result, but guard it only with an is_directory_name_allowed() task-name-collision check rather than the PathSecurityValidator.validate_local_path() guard used by the jinja command, so an absolute path or one containing traversal sequences escapes the workspace and writes files under an attacker-chosen location as the invoking process owner. The security boundary is crossed when a trusted CI job, shared service, or wrapper derives the output argument from repository-controlled, tenant-controlled, or otherwise untrusted data while expecting output to stay inside the workspace. When --force-overwrite is used, the selected output directory is first recursively deleted, extending the primitive to destruction of an attacker-chosen directory tree and enabling indirect code execution by overwriting files a pipeline later runs. This issue is fixed in versions 3.12.4 and 4.1.0.
AnalysisAI
Arbitrary file write and directory deletion in compliance-trestle's catalog-generate, profile-generate, and ssp-generate author commands exposes CI/CD pipelines to workspace-escape attacks when output arguments are derived from untrusted data. The affected commands construct output paths by joining a user-supplied argument onto the Trestle workspace root, but apply only a task-name-collision check rather than the PathSecurityValidator guard already used by the jinja command - allowing absolute paths or traversal sequences to escape the workspace entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the output argument supplied to one of the three vulnerable commands (catalog-generate, profile-generate, or ssp-generate) contains an absolute path or a path traversal sequence (e.g., ../../, /tmp/target), AND that this argument is derived from data the attacker can influence - such as repository-controlled configuration files, PR metadata, branch names, or tenant-supplied inputs processed by a CI job. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) accurately reflects a local, low-complexity, unauthenticated file-write primitive with no confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to compliance-trestle 3.12.4 (3.x line) or 4.1.0 (4.x line), as confirmed by the CVE description and the tagged release at https://github.com/oscal-compass/compliance-trestle/releases/tag/v4.1.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all compliance-trestle deployments in CI/CD pipelines and immediately implement a temporary block on the affected commands (catalog-generate, profile-generate, ssp-generate) when receiving user-supplied or untrusted output arguments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today