CVE-2026-57170 Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

🗓️ 25 Aug 2026 23:18:29Reported by GitHub_MType

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse the con...

Reporter	Title	Published	Views	Family All 2
CVE	CVE-2026-57170 Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)	25 Aug 202623:18	–	cve
Positive Technologies	PT-2026-81902	25 Aug 202600:00	–	ptsecurity

[
  {
    "vendor": "oscal-compass",
    "product": "compliance-trestle",
    "versions": [
      {
        "version": "< 3.12.4",
        "status": "affected"
      },
      {
        "version": ">= 4.0.0, < 4.1.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-mr95-65j8-9mxp
github	www.github.com/oscal-compass/compliance-trestle/commit/5335ff873a2a68eb7de43df029bea09cadff22fd
github	www.github.com/oscal-compass/compliance-trestle/commit/0f82d19bd42f9cc0f1b3acd7fc3f6dafe3b6ae10

25 Aug 2026 23:18Current

CVSS 3.17.8