Eclipssec

**Name of the Vulnerable Software and Affected Versions** Compliance-trestle versions prior to 3.12.4 Compliance-trestle versions 4.0.0 through 4.0.3 **Description** Compliance-trestle is subject to server-side template injection, which can lead to remote code execution. This occurs because the `MDCleanInclude` and `MDSectionInclude` Jinja2 tags re-parse untrusted Markdown content as template source code using a non-sandboxed `jinja2.Environment`. An attacker who controls content rendered by the tool, such as a crafted workspace Markdown file, a third-party SSP document, or a YAML lookup-table value, can inject a Jinja2 expression to traverse Python object internals and execute arbitrary operating system commands within the context of the process. **Recommendations** Update versions prior to 3.12.4 to version 3.12.4. Update versions 4.0.0 through 4.0.3 to version 4.1.0.