CVE-2026-57170: Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsectioninclude and mdcleaninclude re-parse the content of an included Markdown file as Jinja2 template code in a non-sandboxed environment, allowing server-side template injection that can lead to arbitrary code execution. The MDSectionInclude and MDCleanInclude tags in Trestle/core/jinja/tags.py pass included file content to Parser(self.environment, ...).parse(), splicing it into the host template's compilation, and the environment is a plain jinja2.Environment rather than a SandboxedEnvironment, so any expressions in the file are evaluated with full access to the usual SSTI gadget chain. Because Trestle's Markdown writers emit OSCAL prose and component-description fields verbatim, applying delimiter neutralization only to parameter tables, attacker-controlled OSCAL data such as a control statement, part prose, or component description containing Jinja2 syntax flows into an included Markdown file and is executed when the include tag re-parses it. This issue is fixed in version 4.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Trestleto a version that resolves this vulnerability.Fixed in 3.12.4 - Upgrade
Upgrade
Trestleto a version that resolves this vulnerability.Fixed in 4.1.0
Event History
Frequently Asked Questions
Which deployments are exposed in practice?
Deployments are exposed when Trestle renders Markdown through the mdsection_include or md_clean_include tags and the included Markdown can contain attacker-controlled OSCAL prose, such as control statements, part prose, or component descriptions. The attacker needs the ability to introduce Jinja2 syntax into that data; the CVSS vector indicates local access with low privileges.
How can I determine whether my installation is affected?
Check the installed Trestle version and whether workflows use the mdsection_include or md_clean_include custom Jinja2 tags. Versions before 3.12.4 and versions from 4.0.0 through 4.0.3 are affected.
What should be done if immediate upgrading is not possible?
Avoid rendering untrusted or externally supplied OSCAL prose through Markdown files used by the vulnerable include tags. In particular, prevent Jinja2 expressions in control statements, part prose, and component descriptions from reaching included Markdown that is re-parsed as a template.
What version resolves the issue?
The issue is fixed in Trestle version 4.1.0.