CVE-2026-54757 oscal-compass CVE debrief

Who should care

Defenders who use Trestle to render untrusted content should prioritize patching or mitigating this vulnerability. This includes operators who manage Trestle instances, platform administrators who support Trestle deployments, vulnerability management teams who track and remediate vulnerabilities, and security teams who oversee risk mitigation efforts. These stakeholders should assess their exposure to this vulnerability and take appropriate actions to rem

Why it matters

CVE-2026-54757 is a high-severity vulnerability in Compliance-trestle (Trestle) that can lead to remote code execution. Defenders who use Trestle to render untrusted content should prioritize patching or mitigating this vulnerability.

• Remote code execution can occur when an attacker injects a Jinja2 expression that traverses Python object internals.
• Defenders should verify the patch level of Trestle instances to ensure they are running a fixed version.
• Defenders should restrict access to Trestle to trusted users only to reduce the attack surface.
• Defenders should monitor Trestle logs for suspicious activity to detect potential exploitation attempts.

Technical summary

The vulnerability is caused by the MDCleanInclude and MDSectionInclude Jinja2 tags re-parsing untrusted Markdown content as template source code using a non-sandboxed jinja2.Environment. This allows an attacker to inject a Jinja2 expression that traverses Python object internals to execute arbitrary operating system commands. The issue affects versions before 3.12.4 and versions 4.0.0 through 4.0.3 of Trestle, a Python SDK and command-line tool for managing OSCAL compliance documents. Defenders should verify the patch level of Trestle instances to ensure they are running a fixed version.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Trestle is used to render untrusted content.

Recommended defensive actions

• Patch Trestle to version 3.12.4 or 4.1.0
• Restrict access to Trestle to trusted users only
• Monitor Trestle logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the MDCleanInclude and MDSectionInclude Jinja2 tags re-parsing untrusted Markdown content as template source code using a non-sandboxed jinja2.Environment. This allows an attacker to inject a Jinja2 expression that traverses Python object internals to execute arbitrary operating system commands.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.