Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
9 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
At a glance - Actor: attacker who controls the -o/--output argument to trestle author {catalog,profile,ssp}-generate (e.g. via a CI pipeline that derives the output directory from repository-controlled data) - Primitive: attacker-controlled --output value reaches trestleroot / args.output write sink with only isdirectorynameallowed() (parts[0]-only task-name-collision check), not the PathSecurityValidator.validatelocalpath() guard added by the CVE-2026-46345 fix - Impact: arbitrary-location file write outside the trestle workspace as the process owner (8.4 High; conservative C:N variant 7.7, still High); with --force-overwrite, the attacker-chosen directory is first recursively deleted shutil.rmtree) - Precondition: attacker influences the -o argument in a CI/automation pipeline or multi-tenant trestle workspace running these generate subcommands - Fix: call PathSecurityValidator.validatelocalpath(markdownpath, trestleroot) immediately after building markdownpath in catalog.py,…
Recommended action: Upgrade to 4.1.0 or 3.12.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Reporter: Cavan Loughran, Celvex Group Inc. Summary ------- The fix for CVE-2026-46439 (3.12.2 / 4.0.3) removed the recursive re-render loop in trestle/core/commands/author/jinja.py rendertemplate, but the custom include tags in trestle/core/jinja/tags.py (MDSectionInclude, MDCleanInclude) still re-parse the CONTENT of an included markdown file as a Jinja2 template via Parser(self.environment, <file text).parse() in a plain (non-sandboxed) jinja2.Environment. Because the trestle markdown writers (sspio.py SSPMarkdownWriter, docscontrolwriter.py DocsControlWriter) write OSCAL prose / component-description fields verbatim (the {{ - [ neutralization is applied to parameter tables only), attacker-controlled OSCAL data that flows into an included markdown file is interpreted as template code and can achieve arbitrary code execution on the runner. This is the same trust boundary and impact as CVE-2026-46439 via a sink the fix did not cover. Affected versions ----------------- 4.0.3 and…
Recommended action: Upgrade to 4.1.0 or 3.12.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A Server-Side Template Injection (SSTI) vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code paths. The core anti-pattern is: treating runtime data (rendered output, included Markdown content, LUT values) as Jinja2 template source code and passing it to Parser.parse() or an equivalent rendering cycle, without using SandboxedEnvironment or escaping Jinja2 syntax delimiters. Because jinja2.Environment (not SandboxedEnvironment) is used, injected expressions can traverse Python object chains (class.mro, globals, subclasses()) to achieve arbitrary command execution via os.system() or subprocess. Previously fixed instance (historical context): An earlier version of rendertemplate() in trestle/core/commands/author/jinja.py implemented a recursive while loop: rendered output was loaded via…
Recommended action: Upgrade to 4.1.0 or 3.12.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
compliance-trestle 4.0.3 (latest) ships an URLSecurityValidator in trestle/core/remote/security.py to block SSRF to loopback / link-local / cloud-metadata endpoints from the HTTPSFetcher and SFTPFetcher remote-fetch paths. The allowlist is incomplete and can be bypassed by four equivalent address representations that resolve to the same blocked host but evade the validator's checks: - IPv4-mapped IPv6 literals ([::ffff:169.254.169.254], [::ffff:127.0.0.1], [::ffff:10.0.0.1]) are returned by socket.getaddrinfo as IPv6Address objects; IPv6Address in IPv4Network('169.254.0.0/16') returns False, so the checkblockednetworks and checkprivatenetworks predicates do not match. - IPv4 unspecified address 0.0.0.0 is not in ALWAYSBLOCKEDNETWORKS (which covers 127.0.0.0/8 but not 0.0.0.0/8); on Linux + Docker, 0.0.0.0 routes to local services on any interface, and on dual-stack-mapped sockets it also reaches loopback listeners. A malicious OSCAL profile referencing one of these URLs in…
Recommended action: Upgrade to 4.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A High severity Server-Side Template Injection (SSTI) vulnerability exists in the trestle author jinja command. The command recursively evaluates rendered templates, allowing an attacker to achieve arbitrary command execution with privileges of the running process by injecting malicious payloads into data fields (such as SSP documents or Lookup Tables). The vulnerability does not require attacker control of the template itself. Only attacker-controlled input data rendered into a trusted template is required. This distinction is critical: the template author may only intend to render plain text (e.g., Title: {{ ssp.metadata.title }}), but because of the recursive parsing, the data field itself becomes executable. The vulnerability is caused by recursive re-compilation and re-rendering of already-rendered output. Details In trestle/core/commands/author/jinja.py, the rendertemplate method performs recursive template evaluation to allow nesting within expressions: When a fully trusted…
Recommended action: Upgrade to 4.0.3 or 3.12.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A source code audit led to the discovery of three significant security vulnerabilities in the trestle/core/remote/cache.py module. Finding 1 (Critical): SSRF (CWE-918) The HTTPSFetcher.dofetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints (e.g., 169.254.169.254). Per rule 4.2.11 of the CVE CNA rules Finding 1 will be addressed in this advisory, while findings 2 & 3 will be addressed in separate advisories: --- Multiple Path Traversal Vulnerabilities in Remote Fetching Subsystem Finding 2 & 3 (High/Medium): Path Traversal (CWE-22) The caching logic for HTTPSFetcher and LocalFetcher fails to sanitize URI paths, allowing for arbitrary file reads via file:// or writing cached files outside the intended directory. Impact: These vulnerabilities can be chained to exfiltrate sensitive cloud credentials or compromise CI/CD environments.…
Recommended action: Upgrade to 4.0.3 or 3.12.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Relevant Products/Components: trestle/core/commands/author/jinja.py trestle author jinja --- Detailed Description: The -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate: ../ ..\ absolute paths This allows arbitrary file write to attacker-controlled locations. Vulnerable code: An attacker can overwrite files such as: .github/workflows/.yml .git/hooks/ user writable config files This can lead to CI/CD compromise or local code execution. --- Steps To Reproduce: 1. Clone the repository: 2. Create template: 3. Run: 4. Observe: The file is written outside the repository workspace. --- Browsers Verified In: Not browser related. Tested on: Windows 11 Python 3.13 --- Supporting Material/References: Affected file: Successfully verified: directory traversal using ../ Windows traversal using ..\ arbitrary file write outside workspace --- Access Vector Required for Exploitation: Local --- Vulnerability…
Recommended action: Upgrade to 4.0.3 or 3.12.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The compliance-trestle library's profile import mechanism resolves trestle:// URIs and relative file paths by joining them with trestleroot and calling .resolve(), but performs no boundary check to ensure the resolved path stays within the trestle workspace. An attacker can craft a malicious OSCAL profile YAML with imports[].href containing path traversal sequences to read arbitrary files from the server filesystem. Three attack vectors confirmed: 1. PT-001: trestle://../../etc/passwd — via trestle:// URI scheme 2. PT-002: ../../etc/passwd — via relative path in href 3. PT-003: backmatter rlinks with traversal paths Preconditions: Victim must import/resolve an attacker-controlled OSCAL profile YAML. Affected Component Repository: https://github.com/IBM/compliance-trestle File: trestle/core/remote/cache.py (lines 175-179) File: trestle/core/resolver/import.py (line 104) Version: v4.0.2 (latest as of 2026-04-30) Vulnerable Code cache.py:175-179 — LocalFetcher (trestle:// URI…
Recommended action: Upgrade to 4.0.3 or 3.12.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The compliance-trestle library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) constructs the local cache file path from the URL path component without sanitizing path traversal sequences (../). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location outside the intended cache directory, enabling arbitrary file write with attacker-controlled content to the filesystem. Attack chain: Malicious OSCAL profile → HTTPS fetch → cache path traversal → arbitrary file write → RCE (via cron, SSH keys, etc.) Affected Component Repository: https://github.com/IBM/compliance-trestle File: trestle/core/remote/cache.py (lines 259-266 for HTTPSFetcher, lines 328-333 for SFTPFetcher) Version: v4.0.2 (latest as of 2026-04-30) Vulnerable Code cache.py:259-266 — HTTPSFetcher cache path construction cache.py:285-295 — Content written to traversed path cache.py:328-333 — SFTPFetcher (identical pattern) Root Cause: 1.…
Recommended action: Upgrade to 4.0.3 or 3.12.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.