oscal-compass/compliance-trestle Security Advisories | GitStock

high2026-09-24

Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

GHSA-r4vp-3vw6-r2x5 · CVE-2026-57171

high2026-09-24

Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

GHSA-mr95-65j8-9mxp · CVE-2026-57170

high2026-08-28

Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

GHSA-jw39-3688-r4rx · CVE-2026-54757

high2026-08-12

compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

GHSA-h47f-gmjp-m7rr · CVE-2026-52776

high2026-05-28

compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)

GHSA-gg2g-p7xc-qqmm · CVE-2026-46439

medium2026-05-28

compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

GHSA-w76h-q7c6-jpjp · CVE-2026-46380

high2026-05-28

compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

GHSA-4q5v-7g7x-j79w · CVE-2026-46345

medium2026-05-28

compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal

GHSA-mj4x-vf5c-5xg8 · CVE-2026-45774

high2026-05-27

compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal

GHSA-g3vg-vx23-3858 · CVE-2026-45725