Answer in brief
CVE-2026-57170 records a High severity (CVSS 7.8) vulnerability in Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439). The current sources do not mark it as known exploited. The current feed maps oscal-compass/compliance-trestle (generic), compliance-trestle (pip), compliance-trestle (pip), compliance-trestle (pypi) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps oscal-compass/compliance-trestle (generic), compliance-trestle (pip), compliance-trestle (pip), compliance-trestle (pypi) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| oscal-compass/compliance-trestlegeneric | <3.12.4 || >=4.0.0 <4.1.0 | 3.12.4, 4.1.0 |
| compliance-trestlepip | <3.12.4 | 3.12.4 |
| compliance-trestlepip | >=4.0.0,<4.1.0 | 4.1.0 |
| compliance-trestlepypi | >=0 <3.12.4 >=4.0.0 <4.1.0 | 3.12.4, 4.1.0 |
| compliance-trestlepypi | >=0 <3.12.4 | 3.12.4 |
| compliance-trestlepypi | >=4.0.0 <4.1.0 | 4.1.0 |
Published upstream
Aug 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 25, 2026
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse the content of an included Markdown file as Jinja2 template code in a non-sandboxed environment, allowing server-side template injection that can lead to arbitrary code execution. The MDSectionInclude and MDCleanInclude tags in Trestle/core/jinja/tags.py pass included file content to Parser(self.environment, ...).parse(), splicing it into the host template's compilation, and the environment is a plain jinja2.Environment rather than a SandboxedEnvironment, so any expressions in the file are evaluated with full access to the usual SSTI gadget chain. Because Trestle's Markdown writers emit OSCAL prose and component-description fields verbatim, applying delimiter neutralization only to parameter tables, attacker-controlled OSCAL data such as a control statement, part prose, or component description containing Jinja2 syntax flows into an included Markdown file and is executed when the include tag re-parses it. This issue is fixed in version 4.1.0.
Quoted source text, attributed separately from HOL analysis.