CVE-2026-57170 Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
Attacker-controlled OSCAL data triggers server-side template injection in Trestle, leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57170?
CVE-2026-57170 is a high-severity code injection vulnerability in oscal-compass compliance-trestle, published on 25 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse the content of an included Markdown file as Jinja2 template code in a non-sandboxed environment, allowing server-side template injection that can lead to arbitrary code execution. The MDSectionInclude and MDCleanInclude tags in Trestle/core/jinja/tags.py pass included file content to Parser(self.environment, ...).parse(), splicing it into the host template's compilation, and the environment is a plain jinja2.Environment rather than a SandboxedEnvironment, so any expressions in the file are evaluated with full access to the usual SSTI gadget chain. Because Trestle's Markdown writers emit OSCAL prose and component-description fields verbatim, applying delimiter neutralization only to parameter tables, attacker-controlled OSCAL data such as a control statement, part prose, or component description containing Jinja2 syntax flows into an included Markdown file and is executed when the include tag re-parses it. This issue is fixed in version 4.1.0.
Which versions are affected by CVE-2026-57170?
5 open source packages ship an affected version, including compliance-trestle.
| Package | Affected | Fixed in |
|---|---|---|
compliance-trestle PyPI | All versions | 3.12.4, 4.1.0 |
compliance-trestle PyPI | All versions | 3.12.4 |
compliance-trestle PyPI | All versions | 3.12.4 |
compliance-trestle PyPI | From 4.0.0 | 4.1.0 |
compliance-trestle PyPI | From 4.0.0 | 4.1.0 |
How do I fix CVE-2026-57170?
Upgrade compliance-trestle to a fixed version for your release line: 3.12.4 or 4.1.0.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-57170 being exploited?
There is no known exploitation of CVE-2026-57170 in the wild and no public exploit code.
Sources
Also known as GHSA-mr95-65j8-9mxp, PYSEC-2026-4029.