CVE-2026-464397.8HighCWE-1336

CVE-2026-46439: compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)

oscal-compass · compliance-trestle

Affected: oscal-compass compliance-trestle · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.3%probability of exploitation in the next 30 days

19th percentile

050100

Higher than 19% of scored CVEs

7.8HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection (SSTI) vulnerability exists in the `trestle author jinja` command. The command recursively evaluates rendered templates, allowing an attacker to achieve arbitrary command execution with privileges of the running process by injecting malicious payloads into data fields (such as SSP documents or Lookup Tables). The vulnerability does not require attacker control of the template itself. Only attacker-controlled input data rendered into a trusted template is required. This distinction is critical: the template author may only intend to render plain text (e.g., `Title: {{ ssp.metadata.title }}`), but because of the recursive parsing, the data field itself becomes executable. The vulnerability is caused by recursive re-compilation and re-rendering of already-rendered output. Versions 3.12.3 and 4.0.3 patch the issue.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

oscal-compass · compliance-trestle< 3.12.2; >= 4.0.0, < 4.0.3

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Neutralization of Special Elements Used in a Template Engine · Command and Code Injection
Vendor: oscal-compass
Published: August 2026
Band: Unlikely (under 1%), August 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-46439 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.