CVE-2026-57170: Compliance-trestle SSTI RCE Vulnerability

CVE-2026-57170 Overview

CVE-2026-57170 is a server-side template injection (SSTI) vulnerability in Compliance-trestle (Trestle), a Python SDK and command-line tool for managing Open Security Controls Assessment Language (OSCAL) compliance documents. The flaw affects versions prior to 3.12.4 and versions 4.0.0 through 4.0.3. The custom Jinja2 include tags mdsection_include and md_clean_include re-parse included Markdown files as Jinja2 template code inside a non-sandboxed environment. Attacker-controlled OSCAL data flowing through these tags can achieve arbitrary code execution. The issue is fixed in version 4.1.0, with a backport in 3.12.4.

Critical Impact
Attacker-controlled OSCAL prose or component descriptions containing Jinja2 syntax execute with full access to the standard SSTI gadget chain, enabling arbitrary code execution on the host running Trestle.

Affected Products

Compliance-trestle versions prior to 3.12.4
Compliance-trestle versions 4.0.0 through 4.0.3
OSCAL document processing pipelines built on Trestle Jinja include tags

Discovery Timeline

2026-08-26 - CVE-2026-57170 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-57170

Vulnerability Analysis

The vulnerability is a code injection flaw [CWE-94] triggered when Trestle's custom Jinja2 include tags process Markdown files containing template syntax. The MDSectionInclude and MDCleanInclude tags in trestle/core/jinja/tags.py pass included file content to Parser(self.environment, ...).parse(). This splices the file content directly into the host template's compilation stage.

Because self.environment is a plain jinja2.Environment rather than a SandboxedEnvironment, any expressions in the included file are evaluated with unrestricted Python semantics. An attacker can chain standard SSTI gadgets to reach os.system, subprocess, or other execution primitives through Python object introspection.

Exploitation requires local access with low privileges and no user interaction, since Trestle typically runs in developer or compliance pipelines that ingest OSCAL data from repositories or shared filesystems.

Root Cause

Trestle's Markdown writers emit OSCAL prose and component-description fields verbatim into generated Markdown files. Delimiter neutralization was applied only to parameter tables, not to control statements, part prose, or component descriptions. When the include tag later re-parses the resulting Markdown, embedded Jinja2 syntax such as {{ ... }} is compiled and executed by the non-sandboxed environment.

Attack Vector

An attacker supplies OSCAL data containing Jinja2 template syntax through a control statement, part prose, or component description. Trestle writes this content into a Markdown file. When a downstream Jinja2 template uses mdsection_include or md_clean_include to pull that file in, the payload is compiled as template code and executed in the Trestle process context.

python

# Security patch: defense-in-depth delimiter neutralization
# trestle/core/docs_control_writer.py
def _neutralize_jinja_delimiters(text: str) -> str:
    """Neutralize Jinja2 template delimiters to prevent SSTI attacks.

    Replaces {{ and }} with [[ and ]] to prevent untrusted OSCAL data
    from being interpreted as Jinja2 template code when included in
    markdown files that are later processed by Jinja2 include tags.
    """
    if not text:
        return text
    return text.replace('{{', '[[').replace('}}', ']]')

Source: GitHub Commit 0f82d19

Detection Methods for CVE-2026-57170

Indicators of Compromise

OSCAL documents containing Jinja2 delimiters {{, }}, {%, or %} inside prose, part, or component-description fields.
Unexpected child processes spawned by Python processes running trestle commands, especially shells or network utilities.
Markdown artifacts generated by Trestle that contain template expressions referencing Python object attributes such as __class__, __mro__, or __subclasses__.

Detection Strategies

Scan OSCAL JSON and YAML inputs for Jinja2 delimiter patterns before running Trestle workflows.
Audit generated Markdown files under md/ output directories for embedded template syntax originating from untrusted OSCAL fields.
Instrument continuous integration pipelines to log Trestle version metadata and flag versions below 3.12.4 or in the 4.0.0–4.0.3 range.

Monitoring Recommendations

Monitor process trees for Python interpreters spawning sh, bash, cmd.exe, or powershell.exe during OSCAL rendering jobs.
Alert on outbound network connections initiated by build agents that execute Trestle CLI commands.
Track file writes to sensitive locations by Trestle processes as an indicator of successful template injection.

How to Mitigate CVE-2026-57170

Immediate Actions Required

Upgrade Compliance-trestle to version 4.1.0 or later. For the 3.x line, upgrade to 3.12.4 which contains the backported fix.
Inventory all OSCAL sources feeding Trestle pipelines and treat externally sourced content as untrusted.
Rotate any credentials or secrets accessible from build environments where vulnerable Trestle versions processed third-party OSCAL data.

Patch Information

The fix is available in Compliance-trestle 4.1.0 and backported to 3.12.4. Review the GitHub Security Advisory GHSA-mr95-65j8-9mxp, the primary fix commit 0f82d19, and the 3.x backport commit 5335ff8 for implementation details. The patch stops the include tags from re-parsing file content as templates and neutralizes {{ and }} in OSCAL prose fields as defense in depth.

Workarounds

Avoid using mdsection_include and md_clean_include on Markdown files derived from untrusted OSCAL inputs until the upgrade is applied.
Pre-process OSCAL data to replace {{ and }} with inert placeholders before invoking Trestle Markdown writers.
Run Trestle inside an isolated, least-privileged container with no network egress and no access to secrets when processing third-party compliance content.

bash

# Pin the fixed version in your Python environment
pip install --upgrade 'compliance-trestle>=4.1.0'

# Or, for the 3.x line
pip install --upgrade 'compliance-trestle>=3.12.4,<4.0.0'

# Verify the installed version
trestle version