CVE-2026-57171: Compliance-trestle Path Traversal Vulnerability

CVE-2026-57171 Overview

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing Open Security Controls Assessment Language (OSCAL) compliance documents. CVE-2026-57171 is a path traversal vulnerability [CWE-22] affecting the catalog-generate, profile-generate, and ssp-generate author commands. These commands write generated Markdown to an attacker-influenced output path without validating for traversal sequences or absolute paths. The flaw allows arbitrary file write outside the Trestle workspace, and when combined with --force-overwrite, enables recursive deletion of attacker-chosen directories. The issue affects versions prior to 3.12.4 and versions 4.0.0 through 4.0.3.

Critical Impact
Attackers who influence the output argument in a trusted CI job or shared service can write or delete files anywhere the invoking process can reach, enabling indirect code execution by overwriting pipeline artifacts.

Affected Products

Compliance-trestle versions prior to 3.12.4
Compliance-trestle versions 4.0.0 through 4.0.3
OSCAL author tooling deployed in CI/CD pipelines using vulnerable Trestle versions

Discovery Timeline

2026-08-26 - CVE-2026-57171 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-57171

Vulnerability Analysis

The vulnerability resides in the author command handlers for catalog-generate, profile-generate, and ssp-generate. Each command joins the user-supplied output argument onto the Trestle workspace root and writes generated Markdown to the resulting path. The only guard applied is is_directory_name_allowed(), which checks for task-name collisions against OSCAL schema names. This check does not reject absolute paths or paths containing .. traversal sequences.

By contrast, the jinja command applies PathSecurityValidator.validate_local_path(), which enforces workspace containment. The inconsistency between the two validation strategies is the root of the issue. Successful exploitation writes files under an attacker-chosen location as the invoking process owner, and use of --force-overwrite first recursively deletes the target directory before writing.

Root Cause

The root cause is missing path canonicalization and containment enforcement in the affected author commands. A repository-controlled or tenant-controlled string is treated as a trusted relative path fragment when it may in fact be absolute or contain traversal components. The patched code adds defense-in-depth rejection of absolute paths and .. components in trestle/common/file_utils.py, and imports PathSecurityValidator into the catalog author command.

Attack Vector

Exploitation requires that a trusted context, such as a CI job, shared service, or automation wrapper, derives the output argument from untrusted data while expecting the write to remain inside the workspace. An attacker submits a repository or tenant input containing an absolute path or traversal sequence. The vulnerable command then writes generated files outside the workspace, or with --force-overwrite, destroys an attacker-chosen directory tree. Overwriting files that a later pipeline stage executes yields indirect code execution.

python

     # Task must not self-interfere with a project
     pathed_name = pathlib.Path(name)
 
+    # Defense-in-depth: reject absolute paths
+    # Check both is_absolute() and if path starts with '/' to handle Unix-style paths on Windows
+    if pathed_name.is_absolute() or name.startswith('/'):
+        logger.warning('Task name must not be an absolute path')
+        return False
+
+    # Defense-in-depth: reject any path containing ".." components
+    if '..' in pathed_name.parts:
+        logger.warning('Task name must not contain ".." path traversal sequences')
+        return False
+
     root_path = pathed_name.parts[0]
     if root_path in const.MODEL_TYPE_TO_MODEL_DIR.values():
         logger.warning('Task name is the same as an OSCAL schema name.')

Source: GitHub Commit 37ed44f5. This patch adds absolute-path and traversal-sequence rejection to is_directory_name_allowed() in trestle/common/file_utils.py.

Detection Methods for CVE-2026-57171

Indicators of Compromise

Trestle author command invocations where the output argument begins with /, a Windows drive letter, or contains .. segments
Unexpected Markdown files appearing outside the declared Trestle workspace root on CI runners or shared build hosts
CI job logs showing catalog-generate, profile-generate, or ssp-generate execution followed by writes to system directories or pipeline tool paths
Recursive directory deletions coinciding with --force-overwrite flag usage in Trestle commands

Detection Strategies

Audit CI/CD pipeline definitions and wrapper scripts for Trestle author commands that pass user-controlled or repository-controlled values into the output argument
Monitor file system telemetry on build hosts for writes originating from the Python process running Trestle that land outside the intended workspace
Inventory installed Trestle versions across build environments and flag any version below 3.12.4 or in the 4.0.0–4.0.3 range

Monitoring Recommendations

Enable process and file-write telemetry on CI runners and correlate Trestle process events with target write paths
Alert on modifications to CI configuration files, deployment manifests, or subsequent-stage script directories following Trestle command execution
Track use of --force-overwrite in build logs and require review for any invocation where the target path is not statically defined

How to Mitigate CVE-2026-57171

Immediate Actions Required

Upgrade Compliance-trestle to version 3.12.4 or 4.1.0 across all environments that run OSCAL author commands
Audit CI/CD jobs and shared services that invoke catalog-generate, profile-generate, or ssp-generate and remove any flow where the output argument is derived from untrusted input
Revoke and rotate secrets on any build host where a vulnerable Trestle version processed attacker-controlled inputs

Patch Information

The issue is fixed in Compliance-trestle 3.12.4 and 4.1.0. See the GitHub Release v4.1.0, the Security Advisory GHSA-4q5v-7g7x-j79w, and the Security Advisory GHSA-r4vp-3vw6-r2x5. The fix imports PathSecurityValidator into the affected author commands and adds absolute-path and traversal rejection to is_directory_name_allowed().

Workarounds

Constrain the output argument to a hard-coded, static path inside the Trestle workspace root and refuse any dynamic value
Run Trestle author commands as an unprivileged user with file system access restricted to the workspace directory only
Disable use of --force-overwrite in automated pipelines until the upgrade is deployed
Validate output arguments in wrapper scripts by rejecting absolute paths and any string containing .. before invoking Trestle

bash

# Configuration example: upgrade and constrain execution
pip install --upgrade 'compliance-trestle>=4.1.0'

# Or for the 3.x line
pip install --upgrade 'compliance-trestle>=3.12.4,<4.0.0'

# Wrapper-level validation prior to invocation
case "$OUTPUT_DIR" in
  /*|*..*) echo "Rejected unsafe output path"; exit 1 ;;
esac
trestle author catalog-generate -n mycat -o "$OUTPUT_DIR"