CVE-2026-45774 oscal-compass CVE debrief

Who should care

Defenders responsible for managing compliance as code with compliance-trestle should assess exposure and prioritize verification and remediation. They should verify compliance-trestle versions and update to patched versions 3.12.3 or 4.0.3, and review OSCAL profile YAML imports for potential path traversal sequences. Additionally, they should implement boundary checks for `trestle://` URIs and relative file paths to prevent path traversal attacks.

Why it matters

CVE-2026-45774 allows path traversal attacks in compliance-trestle, enabling attackers to read arbitrary files from the server filesystem. Defenders should prioritize verifying compliance-trestle versions and updating to patched versions, and review OSCAL profile YAML imports for potential path traversal sequences.

• Path traversal attacks can lead to unauthorized file reads
• Compliance-trestle versions prior to 3.12.3 or 4.0.3 are vulnerable
• OSCAL profile YAML imports require review for potential path traversal sequences

Technical summary

The compliance-trestle library's profile import mechanism resolves `trestle://` URIs and relative file paths by joining them with `trestle_root` and calling `.resolve()`, but performs no boundary check to ensure the resolved path stays within the trestle workspace. This allows an attacker to craft a malicious OSCAL profile YAML with `imports[].href` containing path traversal sequences to read arbitrary files from the server filesystem. The vulnerability can be mitigated by updating to patched versions 3.12.3 or 4.0.3 and reviewing OSCAL profile YAML imports for potential path traversal sequences.

Defensive priority

Defenders should prioritize verifying compliance-trestle versions and updating to patched versions 3.12.3 or 4.0.3, and review OSCAL profile YAML imports for potential path traversal sequences.

Recommended defensive actions

• Verify compliance-trestle versions and update to patched versions 3.12.3 or 4.0.3
• Review OSCAL profile YAML imports for potential path traversal sequences
• Implement boundary checks for `trestle://` URIs and relative file paths
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by the compliance-trestle library's profile import mechanism resolving `trestle://` URIs and relative file paths without boundary checks, allowing path traversal attacks. The compliance-trestle library's profile import mechanism resolves `trestle://` URIs and relative file paths by joining them with `trestle_root` and calling `.resolve()`, but performs no boundary check to ensure the resolved path stays within the trestle workspace. This allows an attacker to craft a malicious OSCAL profile YAML with `trest

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.