{"id":11837,"date":"2026-09-04T18:53:54","date_gmt":"2026-09-04T10:53:54","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-57170"},"modified":"2026-09-04T18:53:54","modified_gmt":"2026-09-04T10:53:54","slug":"cve-2026-57170","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-57170","title":{"rendered":"CVE-2026-57170 [HIGH] &#8211; Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL comp"},"content":{"rendered":"<p>Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse the content of an included Markdown file as Jinja2 template code in a non-sandboxed environment, allowing server-side template injection that can lead to arbitrary code execution. The MDSectionInclude and MDCleanInclude tags in Trestle\/core\/jinja\/tags.py pass included file content to Parser(self.environment, &#8230;).parse(), splicing it into the host template&#8217;s compilation, and the environment is a plain jinja2.Environment rather than a SandboxedEnvironment, so any expressions in the file are evaluated with full access to the usual SSTI gadget chain. Because Trestle&#8217;s Markdown writers emit OSCAL prose and component-description fields verbatim, applying delimiter neutralization only to parameter tables, attacker-controlled OSCAL data such as a control statement, part prose, or component description containing Jinja2 syntax flows into an included Markdown file and is executed when the include tag re-parses it. This issue is fixed in version 4.1.0.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsectio<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11837","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11837","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11837"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11837"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11837"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}