Server-Side Template Injection Vulnerability in Compliance-Trestle by OSCAL Compass
CVE-2026-46439
What is CVE-2026-46439?
Compliance-Trestle, a tooling platform for managing compliance as code, contains a vulnerability that allows for Server-Side Template Injection (SSTI) through its trestle author jinja command. This vulnerability enables an attacker to execute arbitrary commands with the privileges of the running process by injecting malicious payloads into input fields, such as SSP documents or Lookup Tables. Importantly, attackers do not need control over the templates themselves; they can exploit any untrusted input data rendered into a trusted template. This flaw arises from the platform's recursive evaluation and re-rendering of previously rendered outputs. Versions 3.12.3 and 4.0.3 have been released to address this issue.
Affected Version(s)
compliance-trestle < 3.12.2 < 3.12.2
compliance-trestle >= 4.0.0, < 4.0.3 < 4.0.0, 4.0.3