oscal-compass vulnerabilities

Newest CVEs

• CVE-2026-57171

  Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

  oscal-compass · compliance-trestle

  High7.7
• CVE-2026-57170

  Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)

  oscal-compass · compliance-trestle

  High7.8
• CVE-2026-52776

  Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

  oscal-compass · compliance-trestle

  High8.6
• CVE-2026-54757

  Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

  oscal-compass · compliance-trestle

  High7.8
• CVE-2026-46345

  compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

  oscal-compass · compliance-trestle

  High8.4
• CVE-2026-46380

  compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

  oscal-compass · compliance-trestle

  Medium6.7
• CVE-2026-46439

  compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)

  oscal-compass · compliance-trestle

  High7.8
• CVE-2026-45774

  compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal

  oscal-compass · compliance-trestle

  Medium6.9
• CVE-2026-45725

  compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal

  oscal-compass · compliance-trestle

  High7.1