Path Traversal Vulnerability in Compliance-Trestle Python SDK by OSCAL Compass
CVE-2026-57171
What is CVE-2026-57171?
Compliance-Trestle, a Python SDK for managing OSCAL compliance documents, is vulnerable to path traversal attacks in certain versions. Specifically, versions prior to 3.12.4, along with versions 4.0.0 to 4.0.3, allow attackers to manipulate output paths for generated Markdown files, enabling arbitrary file writes outside the intended workspace. This occurs because the output argument from user-provided data is not properly validated, leading to potential exploitation when untrusted data is integrated into trusted CI jobs. Additionally, the use of the --force-overwrite option can allow for unintended deletion of directories, facilitating further exploitable scenarios. This vulnerability has been addressed in versions 3.12.4 and 4.1.0 of Compliance-Trestle.
Affected Version(s)
compliance-trestle < 3.12.4 < 3.12.4
compliance-trestle >= 4.0.0, < 4.1.0 < 4.0.0, 4.1.0