CVE-2026-57170
- Source
- https://cve.org/CVERecord?id=CVE-2026-57170
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57170.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-57170
- Aliases
- Published
- 2026-08-25T23:18:29Z
- Modified
- 2026-10-28T02:30:42Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
- Details
-
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse the content of an included Markdown file as Jinja2 template code in a non-sandboxed environment, allowing server-side template injection that can lead to arbitrary code execution. The MDSectionInclude and MDCleanInclude tags in Trestle/core/jinja/tags.py pass included file content to Parser(self.environment, ...).parse(), splicing it into the host template's compilation, and the environment is a plain jinja2.Environment rather than a SandboxedEnvironment, so any expressions in the file are evaluated with full access to the usual SSTI gadget chain. Because Trestle's Markdown writers emit OSCAL prose and component-description fields verbatim, applying delimiter neutralization only to parameter tables, attacker-controlled OSCAL data such as a control statement, part prose, or component description containing Jinja2 syntax flows into an included Markdown file and is executed when the include tag re-parses it. This issue is fixed in version 4.1.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-1336", "CWE-94" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57170.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57170.json
- https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-mr95-65j8-9mxp
- https://nvd.nist.gov/vuln/detail/CVE-2026-57170
- https://github.com/oscal-compass/compliance-trestle/commit/0f82d19bd42f9cc0f1b3acd7fc3f6dafe3b6ae10
- https://github.com/oscal-compass/compliance-trestle/commit/5335ff873a2a68eb7de43df029bea09cadff22fd
Affected packages
Git / github.com/oscal-compass/compliance-trestle
Affected ranges
- Type
- GIT
- Repo
- https://github.com/oscal-compass/compliance-trestle
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "3.12.4" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "4.0.0" }, { "fixed": "4.1.0" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "0f82d19bd42f9cc0f1b3acd7fc3f6dafe3b6ae10" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "5335ff873a2a68eb7de43df029bea09cadff22fd" } ], "source": "REFERENCES_COMMIT" } ] }