CVE-2026-46345 compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate, ../, .., or absolute paths. This allows...

CVE-2026-46345

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate, ../, .., or absolute paths. This allows...

CVE-2026-46345 compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate, ../, .., or absolute paths. This allows...

CVE-2026-46345

The vulnerable code output_file = trestle_root / r_output_file in trestle/core/commands/author/jinja.py accepts unvalidated -o/--output paths, enabling ../, ..\, or absolute path traversal. Exploitation is trivial (single command, no auth) and can overwrite .github/workflows/*.yml, .git/hooks/*, ...

CVE-2026-46439 compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)

compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection SSTI vulnerability exists in the trestle author jinja command. The command recursively evaluates rendered templates, allowing an attacker to achieve...

CVE-2026-46439 compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)

compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection SSTI vulnerability exists in the trestle author jinja command. The command recursively evaluates rendered templates, allowing an attacker to achieve...

CVE-2026-46439

CVE-2026-46439 (compliance-trestle SSTI): A Server-Side Template Injection exists in the TreSTLE tool when running the command trestle author jinja. The vulnerability arises from recursive re-rendering of data-bound templates, allowing an attacker-controlled payload embedded in SSPs or Lookup Tab...

EUVD-2026-57219

A stored cross-site scripting XSS vulnerability existed in Vulnerability-Lookup in the rendertagbadges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references.tags were directly interpolated into HTML badge elements and the resultin...

CVE-2026-73374 Stored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookup

A stored cross-site scripting XSS vulnerability existed in Vulnerability-Lookup in the rendertagbadges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references.tags were directly interpolated into HTML badge elements and the resultin...

CVE-2026-73374

CVE-2026-73374 describes a stored XSS in Vulnerability-Lookup’s render_tag_badges Jinja filter. Values from containers.cna.references[].tags[] were interpolated into HTML badge markup and wrapped with MarkupSafe.Markup, bypassing Jinja escaping. An authenticated user with vulnerability:create/mod...

CVE-2026-73374

A stored cross-site scripting XSS vulnerability existed in Vulnerability-Lookup in the rendertagbadges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references.tags were directly interpolated into HTML badge elements and the resultin...

PT-2026-71082

A stored cross-site scripting XSS vulnerability existed in Vulnerability-Lookup in the render tag badges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references.tags were directly interpolated into HTML badge elements and the...

CVE-2026-71446

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...

CVE-2026-71502 Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

CVE-2026-18581

A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input 9|9| can lead to reachable assertion. The attack requires...

DEBIAN-CVE-2026-18581

A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input 9|9| can lead to reachable assertion. The attack requires...

UBUNTU-CVE-2026-18581

A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input 9|9| can lead to reachable assertion. The attack requires...

CVE-2026-18581 ggml-org llama.cpp Jinja Minja Template parser.cpp assertion

A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input 9|9| can lead to reachable assertion. The attack requires...

CVE-2026-18581

A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input 9|9| can lead to reachable assertion. The attack requires...

CVE-2026-18581

The CVE-2026-18581 entry concerns ggml-org llama.cpp (e15efe0) and affects the Jinja Minja Template Parser component, specifically the file common/jinja/parser.cpp. The issue arises from manipulating input {{9|9|{}, which can trigger a reachable assertion. Exploitation requires local access, and ...