CVE-2026-46439

compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection SSTI vulnerability exists in the "trestle author jinja" command. The command recursively evaluates rendered templates, allowing an attacker to achieve...