Description

compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection (SSTI) vulnerability exists in the `trestle author jinja` command. The command recursively evaluates rendered templates, allowing an attacker to achieve arbitrary command execution with privileges of the running process by injecting malicious payloads into data fields (such as SSP documents or Lookup Tables). The vulnerability does not require attacker control of the template itself. Only attacker-controlled input data rendered into a trusted template is required. This distinction is critical: the template author may only intend to render plain text (e.g., `Title: {{ ssp.metadata.title }}`), but because of the recursive parsing, the data field itself becomes executable. The vulnerability is caused by recursive re-compilation and re-rendering of already-rendered output. Versions 3.12.3 and 4.0.3 patch the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-14T17:18:14.853Z",
  "pubdate": "2026-08-14T17:18:14.853Z",
  "executiveSummary": "A Server-Side Template Injection (SSTI) vulnerability exists in the compliance-trestle tooling platform, specifically within the trestle author jinja command. The flaw arises from recursive re-compilation and re-rendering of already-rendered template output. This allows an attacker who controls input data—such as SSP documents or Lookup Tables—rendered into a trusted template to achieve arbitrary command execution with the privileges of the running process. The vulnerability affects compliance-trestle versions prior to 3.12.2 and 4.0.3. Crucially, exploitation does not require attacker control over the template file itself; merely controlling the data fields processed by the template is sufficient. This introduces significant risk to environments processing untrusted compliance documents, potentially leading to complete system compromise, unauthorized data access, and execution of arbitrary code within the host context.",
  "technicalDetails": "The vulnerability resides in the trestle author jinja command of the compliance-trestle platform. The root cause of the Server-Side Template Injection is the implementation of recursive evaluation, where rendered templates and their corresponding outputs undergo continuous re-compilation and re-rendering. When a template author writes a seemingly benign template intended solely for plain text rendering—such as Title: {{ ssp.metadata.title }}—the underlying engine parses the data fields themselves. If an adversary supplies malicious payloads within data fields like SSP documents or Lookup Tables, the recursive parsing engine treats those injected data strings as executable template syntax rather than literal text. Consequently, evaluating these nested templates triggers execution within the Python runtime environment, enabling arbitrary command execution. The attack flow involves an adversary supplying crafted input data via controlled data fields. When the vulnerable trestle author jinja command processes this input against a trusted template, the recursive rendering engine evaluates the embedded malicious expressions. This results in the execution of arbitrary system commands leveraging the execution context and privileges of the running compliance-trestle process. Affected versions include all releases prior to 3.12.2 and versions in the 4.x branch prior to 4.0.3. The vulnerability does not mandate prior authentication to the application logic if external data sources are ingested automatically, and it executes with whatever local or remote privileges the underlying process possesses."
}