Description

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the MDCleanInclude and MDSectionInclude Jinja2 tags re-parse untrusted Markdown content as template source code using a non-sandboxed jinja2.Environment. An attacker who controls content that Trestle renders, such as a crafted workspace Markdown file, a third-party SSP document, or a YAML lookup-table value, can inject a Jinja2 expression that traverses Python object internals to execute arbitrary operating system commands in the context of the Trestle process. This issue is fixed in versions 3.12.4 and 4.1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-25T23:17:19.277Z",
  "pubdate": "2026-08-25T23:17:19.277Z",
  "executiveSummary": "Compliance-trestle is susceptible to a server-side template injection (SSTI) vulnerability that permits remote code execution (RCE).\nThe vulnerability originates from the insecure handling of Jinja2 tags, specifically MDCleanInclude and MDSectionInclude, which process untrusted Markdown content as template source code without appropriate sandboxing.\nSuccessful exploitation allows an attacker to execute arbitrary operating system commands within the Trestle process context by embedding malicious Jinja2 expressions into input sources such as workspace Markdown files, SSP documents, or YAML configuration lookups.\nThe risk is critical, as it bypasses standard input validation and enables complete system compromise if the Trestle process runs with elevated privileges.\nThe vulnerability affects Compliance-trestle versions prior to 3.12.4 and versions 4.0.0 through 4.0.3.\nExploitation requires the attacker to influence the content rendered by the Trestle SDK, effectively turning the compliance-as-code processing engine into an execution vector for arbitrary payloads.",
  "technicalDetails": "The root cause of this vulnerability is the instantiation of a non-sandboxed jinja2.Environment object that evaluates user-provided input as active template code rather than static data.\nSpecifically, the MDCleanInclude and MDSectionInclude components are designed to facilitate document assembly but fail to sanitize the content before passing it to the Jinja2 rendering engine.\nWhen a user or third party provides a crafted Markdown file, an SSP document, or a YAML-based lookup table containing Jinja2 syntax, the application parses these inputs as legitimate template structures.\nBecause the environment is not constrained, an attacker can leverage Jinja2 expression language to perform Python object introspection and reach the underlying system's runtime environment.\nA typical attack flow involves the following steps: 1) The attacker injects a malicious Jinja2 payload (e.g., {{ self.__init__.__globals__.__builtins__.__import__('os').popen('command').read() }}) into a source file processed by the vulnerable Trestle components. 2) The Trestle SDK reads the file and invokes the MDCleanInclude or MDSectionInclude handlers. 3) The un-sandboxed Jinja2 Environment parses the injected string, triggering the evaluation of the payload. 4) The Python interpreter executes the injected OS command, granting the attacker the same permissions as the Trestle process.\nThis vulnerability is particularly impactful because it converts static compliance documentation into a dynamic execution path, allowing for lateral movement or data exfiltration from the host filesystem.\nThe vulnerability is present in versions before 3.12.4 and 4.0.0 through 4.0.3.\nNo authentication or specific network exposure is required if the attacker can influence the files processed by the tool, such as through a git repository or a supplied document template.\nThe severity is compounded by the fact that many automated compliance workflows operate with elevated system or service-account privileges to interact with security document repositories."
}