Server-Side Template Injection in Compliance-Trestle Python SDK by OSCAL Compass

CVE-2026-54757

What is CVE-2026-54757?

Compliance-Trestle, a Python SDK and command-line tool designed for managing OSCAL compliance documents, is susceptible to a server-side template injection vulnerability. This flaw affects specific versions prior to 3.12.4 and 4.0.0 through 4.0.3. The vulnerability is rooted in the handling of untrusted Markdown content through Jinja2 tags (MDCleanInclude and MDSectionInclude), which re-parse Markdown as source code without adequate sandboxing. An attacker controlling the content rendered by Trestle can execute arbitrary OS commands by injecting malicious Jinja2 expressions, posing a significant security risk. The issue has been addressed in versions 3.12.4 and 4.1.0, underscoring the importance of using updated software to mitigate similar risks.

References