Behavioral Flaw in compliance-trestle Tooling Platform by oscal-compass
CVE-2026-46345
8.4HIGH
What is CVE-2026-46345?
The compliance-trestle tooling platform prior to versions 3.12.2 and 4.0.3 contains a vulnerability that permits files to be written outside the designated workspace. This flaw results from improper validation of user-supplied paths, allowing attackers to exploit the -o/--output argument during the execution of trestle author jinja to write files to arbitrary locations controlled by the attacker. Users are advised to upgrade to versions 3.12.3 or 4.0.3 to mitigate this security risk.
Affected Version(s)
compliance-trestle >= 4.0.0, < 4.0.3 < 4.0.0, 4.0.3
compliance-trestle < 3.12.2 < 3.12.2