CVE-2026-45774 oscal-compass CVE debrief

Who should care

Defenders responsible for managing compliance as code with compliance-trestle should assess exposure and prioritize updating to patched versions. They should verify compliance-trestle versions and update to patched versions 3.12.3 or 4.0.3, and assess exposure of OSCAL profile imports. Security teams and vulnerability management teams should also be aware of the potential impact of this vulnerability on their systems and take steps to mitigate it.

Why it matters

CVE-2026-45774 is a medium-severity vulnerability in compliance-trestle that allows an attacker to read arbitrary files from the server filesystem. Defenders should prioritize verifying compliance-trestle versions and updating to patched versions 3.12.3 or 4.0.3, and assess exposure of OSCAL profile imports.

• Path traversal vulnerability allows reading arbitrary files
• Potential data exposure through OSCAL profile imports
• Need to verify compliance-trestle versions and update to patched versions

Technical summary

The compliance-trestle library's profile import mechanism resolves `trestle://` URIs and relative file paths by joining them with `trestle_root` and calling `.resolve()`, but performs no boundary check to ensure the resolved path stays within the trestle workspace. This oversight enables an attacker to potentially read arbitrary files from the server filesystem by crafting a malicious OSCAL profile YAML with path traversal sequences. The vulnerability is patched in versions 3.12.3 and 4.0.3, which implement boundary checks to prevent path traversal attacks.

Defensive priority

Defenders should prioritize verifying compliance-trestle versions and updating to patched versions 3.12.3 or 4.0.3, and assess exposure of OSCAL profile imports.

Recommended defensive actions

• Verify compliance-trestle versions and update to patched versions 3.12.3 or 4.0.3
• Assess exposure of OSCAL profile imports
• Monitor for suspicious activity related to compliance-trestle
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but evidence is limited to the supplied source corpus. The compliance-trestle library's profile import mechanism is vulnerable to path traversal attacks, allowing an attacker to read arbitrary files from the server filesystem. Defenders should verify compliance-trestle versions and update to patched versions 3.12.3 or 4.0.3.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.