CVE-2026-54757

Name of the Vulnerable Software and Affected Versions Compliance-trestle versions prior to 3.12.4 Compliance-trestle versions 4.0.0 through 4.0.3

Description Compliance-trestle is subject to server-side template injection, which can lead to remote code execution. This occurs because the MDCleanInclude and MDSectionInclude Jinja2 tags re-parse untrusted Markdown content as template source code using a non-sandboxed jinja2.Environment. An attacker who controls content rendered by the tool, such as a crafted workspace Markdown file, a third-party SSP document, or a YAML lookup-table value, can inject a Jinja2 expression to traverse Python object internals and execute arbitrary operating system commands within the context of the process.

Recommendations Update versions prior to 3.12.4 to version 3.12.4. Update versions 4.0.0 through 4.0.3 to version 4.1.0.