CVE-2026-57170

Name of the Vulnerable Software and Affected Versions Compliance-trestle versions prior to 3.12.4 Compliance-trestle versions 4.0.0 through 4.0.3

Description Custom Jinja2 include tags mdsection include and md clean include re-parse the content of included Markdown files as template code within a non-sandboxed environment. This allows server-side template injection (SSTI), a vulnerability where an attacker injects malicious template directives that are executed by the server, potentially leading to arbitrary code execution. The MDSectionInclude and MDCleanInclude tags in Trestle/core/jinja/tags.py pass file content to the Parser(self.environment, ...).parse() function using a standard jinja2.Environment instead of a SandboxedEnvironment. Consequently, attacker-controlled OSCAL data—such as control statements, part prose, or component descriptions—containing Jinja2 syntax is executed when the include tag re-parses the file.

Recommendations Update versions prior to 3.12.4 to version 4.1.0. Update versions 4.0.0 through 4.0.3 to version 4.1.0.