6 matches found
PYSEC-2026-4030 Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
At a glance - Actor: attacker who controls the -o/--output argument to trestle author catalog,profile,ssp-generate e.g. via a CI pipeline that derives the output directory from repository-controlled data - Primitive: attacker-controlled --output value reaches trestleroot / args.output write sink...
Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
At a glance- Actor: attacker who controls the -o/--output argument to trestle author catalog,profile,ssp-generate e.g. via a CI pipeline that derives the output directory from repository-controlled data- Primitive: attacker-controlled --output value reaches trestleroot / args.output write sink wi...
Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
At a glance - Actor: attacker who controls the -o/--output argument to trestle author catalog,profile,ssp-generate e.g. via a CI pipeline that derives the output directory from repository-controlled data - Primitive: attacker-controlled --output value reaches trestleroot / args.output write sink...
GHSA-R4VP-3VW6-R2X5 Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
At a glance - Actor: attacker who controls the -o/--output argument to trestle author catalog,profile,ssp-generate e.g. via a CI pipeline that derives the output directory from repository-controlled data - Primitive: attacker-controlled --output value reaches trestleroot / args.output write sink...
CVE-2026-57171: Improper Limitation of a Pathname to a Restricted Directory
Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output...
CVE-2026-57171
Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output...