CVE-2026-54757: Compliance-trestle RCE Vulnerability

CVE-2026-54757 Overview

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing Open Security Controls Assessment Language (OSCAL) compliance documents. CVE-2026-54757 is a server-side template injection (SSTI) vulnerability that allows attackers to execute arbitrary operating system commands in the context of the Trestle process. The flaw affects versions before 3.12.4 and versions 4.0.0 through 4.0.3. Exploitation requires that Trestle render attacker-controlled content, such as a crafted workspace Markdown file, a third-party System Security Plan (SSP) document, or a YAML lookup-table value. The issue is fixed in versions 3.12.4 and 4.1.0.

Critical Impact
Attackers who control content rendered by Trestle can inject Jinja2 expressions that traverse Python object internals to execute arbitrary commands, compromising the confidentiality, integrity, and availability of the host process.

Affected Products

Compliance-trestle versions prior to 3.12.4
Compliance-trestle versions 4.0.0 through 4.0.3
Workflows that render untrusted OSCAL Markdown, SSP documents, or YAML lookup values

Discovery Timeline

2026-08-25 - CVE-2026-54757 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-54757

Vulnerability Analysis

The vulnerability is a code injection flaw classified under [CWE-94]. Trestle uses two custom Jinja2 include tags, MDCleanInclude and MDSectionInclude, to embed Markdown content into rendered documents. These tags re-parse the included Markdown as Jinja2 template source using a non-sandboxed jinja2.Environment. An attacker who supplies Markdown or YAML content processed by Trestle can embed a Jinja2 expression that escapes into Python object internals. Using standard SSTI techniques such as walking the __mro__ and __subclasses__ chain, the attacker reaches the os module and runs shell commands. Exploitation requires local access and user interaction, but succeeds against the process performing document rendering.

Root Cause

The root cause is treating untrusted Markdown content as trusted template source. The custom include tags call the Jinja2 parser on included data instead of emitting it as literal text. Because the environment is not sandboxed, expression evaluation has full access to Python built-ins.

Attack Vector

An attacker plants a Jinja2 payload inside any document Trestle renders. Vectors include a workspace Markdown file, a third-party SSP delivered through a supply chain, or a value inside a YAML lookup table. When a user runs a Trestle command that renders the document, the payload executes with the privileges of the invoking user.

python

# Security patch: neutralize Jinja2 delimiters in OSCAL data before rendering
# Source: https://github.com/oscal-compass/compliance-trestle/commit/0f82d19bd42f9cc0f1b3acd7fc3f6dafe3b6ae10

def _neutralize_jinja_delimiters(text: str) -> str:
    """Neutralize Jinja2 template delimiters to prevent SSTI attacks.

    Replaces {{ and }} with [[ and ]] to prevent untrusted OSCAL data
    from being interpreted as Jinja2 template code when included in
    markdown files that are later processed by Jinja2 include tags.

    This is a defense-in-depth measure to complement the primary fix
    of not re-parsing included content as templates.
    """
    if not text:
        return text
    return text.replace('{{', '[[').replace('}}', ']]')

Detection Methods for CVE-2026-54757

Indicators of Compromise

Markdown or YAML files in Trestle workspaces containing Jinja2 delimiters ({{, }}, {%, %}) around Python object introspection tokens such as __class__, __mro__, or __subclasses__.
Unexpected child processes spawned by the Python interpreter running Trestle, particularly shells or network utilities.
Modification of files in /tmp*/*.j2 or /tmp*/*.md.j2 paths generated during rendering.

Detection Strategies

Scan OSCAL and Markdown source content for Jinja2 expressions before ingestion, especially in third-party SSPs.
Inspect Trestle process telemetry for os.system, subprocess.Popen, or popen calls originating from Jinja2 evaluation frames.
Review version manifests in CI/CD pipelines to confirm no build uses Trestle 3.x below 3.12.4 or 4.0.0 through 4.0.3.

Monitoring Recommendations

Log all invocations of Trestle CLI commands and correlate with the source of the input documents.
Alert on Trestle processes performing outbound network connections or writing to sensitive paths.
Track ingestion of third-party OSCAL artifacts and flag documents introducing Jinja2 syntax into fields that should be plain text.

How to Mitigate CVE-2026-54757

Immediate Actions Required

Upgrade Compliance-trestle to version 3.12.4 or 4.1.0 across all environments that process OSCAL content.
Audit existing workspaces, SSP documents, and YAML lookup tables for Jinja2 delimiters before running Trestle commands.
Restrict Trestle execution to trusted content sources and least-privilege service accounts.

Patch Information

The maintainers released fixes in versions 3.12.4 and 4.1.0. The primary fix stops re-parsing included Markdown as Jinja2 template source. A defense-in-depth patch introduces _neutralize_jinja_delimiters, which replaces {{ and }} with [[ and ]] in OSCAL data before it is written into Markdown for later inclusion. Details are available in the GitHub Security Advisory GHSA-jw39-3688-r4rx, the primary fix commit, and the v3 backport commit.

Workarounds

Pre-process untrusted Markdown and YAML to strip or escape Jinja2 delimiters before rendering.
Run Trestle inside an isolated container or sandbox with no network egress and read-only mounts for untrusted inputs.
Reject third-party SSP documents that fail a schema and content review pipeline.

bash

# Configuration example: upgrade to a fixed release
pip install --upgrade 'compliance-trestle>=4.1.0'

# Or, for the v3 branch
pip install --upgrade 'compliance-trestle>=3.12.4,<4.0.0'

# Verify installed version
trestle version