What’s Vulnerable › Products

oscal-compass compliance-trestle vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your oscal-compass compliance-trestle version is affected

Latest oscal-compass compliance-trestle vulnerabilities

• CVE-2026-57171 — Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345) (CVSS 7.7)
• CVE-2026-57170 — Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439) (CVSS 7.8)
• CVE-2026-52776 — Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0 (CVSS 8.6)
• CVE-2026-54757 — Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data (CVSS 7.8)
• CVE-2026-46345 — compliance-trestle - jinja has an Arbitrary File Write via Path Traversal (CVSS 8.4)
• CVE-2026-46439 — compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI) (CVSS 7.8)
• CVE-2026-46380 — compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem (CVSS 6.7)
• CVE-2026-45774 — compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal (CVSS 6.9)
• CVE-2026-45725 — compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal (CVSS 7.1)