Detections
Analytics

SCA: security update for compliance-trestle (GHSA-mr95-65j8-9mxp)

high Tenable Self-Hosted Container Security Plugin ID 448349

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance
 documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags
 mdsection_include and md_clean_include re-parse the content of an included Markdown file as Jinja2
 template code in a non-sandboxed environment, allowing server-side template injection that can lead to
 arbitrary code execution. The MDSectionInclude and MDCleanInclude tags in Trestle/core/jinja/tags.py pass
 included file content to Parser(self.environment, ...).parse(), splicing it into the host template's
 compilation, and the environment is a plain jinja2.Environment rather than a SandboxedEnvironment, so any
 expressions in the file are evaluated with full access to the usual SSTI gadget chain. Because Trestle's
 Markdown writers emit OSCAL prose and component-description fields verbatim, applying delimiter
 neutralization only to parameter tables, attacker-controlled OSCAL data such as a control statement, part
 prose, or component description containing Jinja2 syntax flows into an included Markdown file and is
 executed when the include tag re-parses it. This issue is fixed in version 4.1.0. (CVE-2026-57170)

Solution

Update the compliance-trestle library and its related packages to version 3.12.4 or later.

See Also

https://github.com/advisories/GHSA-mr95-65j8-9mxp

Plugin Details

Severity: High

ID: 448349

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 9/25/2026

Updated: 9/25/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.19

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-57170

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/24/2026

Vulnerability Publication Date: 8/25/2026

Reference Information

CVE: CVE-2026-57170