Server-Side Template Injection in Compliance-Trestle Python SDK
CVE-2026-57170
7.8HIGH
What is CVE-2026-57170?
The Compliance-trestle Python SDK is susceptible to a server-side template injection vulnerability, affecting versions prior to 4.1.0. The custom Jinja2 include tags, mdsection_include and md_clean_include, can re-parse Markdown files in a non-sandboxed environment. This flaw allows attackers to inject and execute arbitrary code within the host template. Specifically, OSCAL data controlled by an attacker can be inserted into Markdown files containing Jinja2 syntax, leading to potential execution of harmful commands when the include tag processes the content. Users are advised to upgrade to version 4.1.0 or later to mitigate this risk.
Affected Version(s)
compliance-trestle < 3.12.4 < 3.12.4
compliance-trestle >= 4.0.0, < 4.1.0 < 4.0.0, 4.1.0