CVE-2026-54757

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the MDCleanInclude and MDSectionInclude Jinja2 tags re-parse untrusted Markdown content as template source code using a non-sandboxed jinja2.Environment. An attacker who controls content that Trestle renders, such as a crafted workspace Markdown file, a third-party SSP document, or a YAML lookup-table value, can inject a Jinja2 expression that traverses Python object internals to execute arbitrary operating system commands in the context of the Trestle process. This issue is fixed in versions 3.12.4 and 4.1.0.

• CWE-94

• https://github.com/oscal-compass/compliance-trestle/commit/0f82d19bd42f9cc0f1b3acd7fc3f6dafe3b6ae10
• https://github.com/oscal-compass/compliance-trestle/commit/5335ff873a2a68eb7de43df029bea09cadff22fd
• https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-jw39-3688-r4rx
• https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-jw39-3688-r4rx

Published

Aug 25, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5475A vulnerability was determined in NASA cFS up to 7.0.0. This…5.5
• CVE-2026-54752NetBox Device Type Library is a collection of community-sour…9.6
• CVE-2026-54753Nx is a monorepo solution for TypeScript and polyglot codeba…5.9
• CVE-2026-54754Klever-Go is the Go implementation of the Klever blockchain …9.6
• CVE-2026-54755Klever-Go is the Go implementation of the Klever blockchain …9.6
• CVE-2026-54756Jodit Editor is a WYSIWYG editor with written in pure TypeSc…6.3
• CVE-2026-54758Notepad++ is a free and open-source source code editor. Prio…7.8
• CVE-2026-54759SiYuan is an open-source personal knowledge management syste…8.7
• CVE-2026-5476A vulnerability was identified in NASA cFS up to 7.0.0 on 32…4.6
• CVE-2026-54760Langroid is a framework for building large-language-model-po…9.3
• CVE-2026-54761Traefik is an HTTP reverse proxy and load balancer. Prior to…7.1
• CVE-2026-54762Traefik is an HTTP reverse proxy and load balancer. From 3.7…8.6