Description

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output path without path-traversal validation, allowing arbitrary file write outside the Trestle workspace. These commands join the user-supplied output argument onto the Trestle root and write to the result, but guard it only with an is_directory_name_allowed() task-name-collision check rather than the PathSecurityValidator.validate_local_path() guard used by the jinja command, so an absolute path or one containing traversal sequences escapes the workspace and writes files under an attacker-chosen location as the invoking process owner. The security boundary is crossed when a trusted CI job, shared service, or wrapper derives the output argument from repository-controlled, tenant-controlled, or otherwise untrusted data while expecting output to stay inside the workspace. When --force-overwrite is used, the selected output directory is first recursively deleted, extending the primitive to destruction of an attacker-chosen directory tree and enabling indirect code execution by overwriting files a pipeline later runs. This issue is fixed in versions 3.12.4 and 4.1.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-26T05:18:11.923Z",
  "pubdate": "2026-08-26T05:18:11.923Z",
  "executiveSummary": "Compliance-trestle (Trestle) is susceptible to an arbitrary file write vulnerability due to inadequate path validation. The issue resides in the catalog-generate, profile-generate, and ssp-generate author commands, which fail to properly sanitize attacker-influenced output paths. This vulnerability allows an attacker to write files outside the intended Trestle workspace, potentially leading to arbitrary code execution or system-wide file destruction.\nThe vulnerability is triggered when a trusted CI job or shared service utilizes untrusted data to define the output destination for these commands. If the --force-overwrite flag is leveraged, the impact is further amplified to arbitrary directory deletion, permitting the destruction of sensitive file systems or the overwriting of binaries and configuration files required for downstream pipeline execution.\nThe vulnerability affects versions prior to 3.12.4 and versions 4.0.0 through 4.0.3. Users are advised to upgrade to version 3.12.4 or 4.1.0 to remediate the flaw. This vulnerability presents a high risk in environments where automated processes derive file paths from external or user-controlled inputs, as it bypasses workspace boundaries to impact the host environment directly.",
  "technicalDetails": "The root cause of this vulnerability is a missing path-traversal validation guard in the Trestle authoring command suite. Specifically, the catalog-generate, profile-generate, and ssp-generate commands perform an insecure join operation on user-supplied output arguments relative to the Trestle root directory.\nWhile the application implements an is_directory_name_allowed() function, this check is designed solely to prevent task-name collisions rather than enforcing security constraints. The application fails to utilize the existing PathSecurityValidator.validate_local_path() mechanism, which is correctly implemented in other modules, such as the jinja command.\nBecause the input argument is not validated for path-traversal sequences (e.g., ../) or absolute path indicators, the application effectively treats the output directory as a controlled input. Consequently, a malicious actor can supply a crafted output path to escape the project workspace and write generated Markdown files into any location accessible to the process owner.\nThe exploitation flow involves the following steps: 1) The attacker provides a payload via an untrusted output path argument (e.g., /etc/cron.d/malicious_job). 2) The Trestle command joins this path, bypassing the insufficient collision check. 3) The application writes generated content to the target location. 4) If the --force-overwrite flag is utilized, the application invokes a recursive deletion on the target path, enabling an attacker to remove arbitrary directory trees.\nThe security boundary is fundamentally compromised when CI pipelines or wrappers rely on repository-controlled or tenant-controlled metadata to designate output destinations. By overwriting critical files—such as scripts, configuration files, or binaries executed by subsequent pipeline stages—an attacker can achieve indirect code execution within the context of the CI runner.\nThe vulnerable component includes the authoring subsystem responsible for processing command-line arguments and file system interaction for generation tasks. Affected versions include all releases before 3.12.4 and the 4.0.x branch up to and including 4.0.3. Authentication and privilege requirements are implicit; the attacker needs only the ability to supply input to the affected commands, which in automated environments is often satisfied by manipulating repository files or CI configurations."
}