Compliance Trestle
Monthly
Server-side template injection in Compliance-Trestle's custom Jinja2 include tags (`mdsection_include` and `md_clean_include`) allows a low-privileged local attacker to achieve arbitrary code execution when attacker-controlled OSCAL data containing Jinja2 syntax is processed during template rendering. All versions prior to 3.12.4 and the 4.0.0-4.0.3 line are affected; the fix is version 4.1.0. No CISA KEV listing or standalone public exploit has been identified at time of analysis, though security test payloads demonstrating the RCE gadget chain are present in the upstream fix commits.
Server-side template injection in Compliance-Trestle's custom Jinja2 include tags (`mdsection_include` and `md_clean_include`) allows a low-privileged local attacker to achieve arbitrary code execution when attacker-controlled OSCAL data containing Jinja2 syntax is processed during template rendering. All versions prior to 3.12.4 and the 4.0.0-4.0.3 line are affected; the fix is version 4.1.0. No CISA KEV listing or standalone public exploit has been identified at time of analysis, though security test payloads demonstrating the RCE gadget chain are present in the upstream fix commits.