CVE-2026-46345

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the "-o/--output" argument in "trestle author jinja" allows writing files outside the intended workspace. The application does not properly validate, "../", "..", or absolute paths. This...