CVE-2026-57171 oscal-compass CVE debrief

Who should care

Defenders responsible for managing OSCAL compliance documents using Compliance-trestle (Trestle) should assess exposure and apply patches or mitigations to prevent potential arbitrary file writes. This includes teams handling CI jobs, shared services, or wrappers that derive output arguments from untrusted data.

Why it matters

CVE-2026-57171 is a high-severity vulnerability in Compliance-trestle (Trestle) that allows for arbitrary file writes outside the workspace due to insufficient path-traversal validation. Defenders should prioritize assessing exposure, applying patches, and implementing additional security controls to mitigate potential risks.

• Potential arbitrary file writes outside the Trestle workspace, allowing for security boundary crossing.
• Possible indirect code execution by overwriting files a pipeline later runs when --force-overwrite is used.
• Need for verification of affected versions, exploitation, and remediation due to limited evidence.
• Priority for defenders to assess exposure and apply patches or mitigations.

Technical summary

The catalog-generate, profile-generate, and ssp-generate author commands in Compliance-trestle (Trestle) write generated Markdown to an attacker-influenced output path without proper path-traversal validation. This allows for arbitrary file writes outside the Trestle workspace, potentially leading to security boundary crossing and indirect code execution. The issue is fixed in versions 3.12.4 and 4.1.0. Defenders should prioritize assessing exposure and applying patches or mitigations to prevent potential arbitrary file writes. The vulnerability can be mitigated by restricting output paths or using PathSecurityValidator.validate_local_path().

Defensive priority

Defenders should prioritize assessing exposure and applying patches or mitigations to prevent potential arbitrary file writes.

Recommended defensive actions

• Assess exposure by identifying systems and deployments using Compliance-trestle (Trestle) versions before 3.12.4 or 4.0.0 through 4.0.3.
• Apply patches or upgrades to versions 3.12.4 or 4.1.0 to fix the vulnerability.
• Implement additional security controls, such as restricting output paths or using PathSecurityValidator.validate_local_path(), to mitigate potential risks.
• Monitor for suspicious activity or potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. The vulnerability is caused by insufficient path-traversal validation in certain commands, allowing for arbitrary file writes outside the Trestle workspace. The issue is fixed in versions 3.12.4 and 4.1.0. Defenders should verify affected versions, exploitation, and remediation due to limited evidence. The CVE Program record and NVD detail page offer source-provided CVE metadata and vulnerability assessments. Additional source-re,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.