THREAT OPS › Threat News › [NVD] CVE-2026-57170 (HIGH 7.8) — Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse the content of an included Markdown file
[NVD] CVE-2026-57170 (HIGH 7.8) — Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse the content of an included Markdown file
CVE-2026-57170 CVSS: 7.8 HIGH Published: 2026-08-26T05:18:11.763
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse the content of an included Markdown file as Jinja2 template code in a non-sandboxed environmen
MITRE ATT&CK techniques
- Template InjectionT1221
Indicators of compromise
- CVE-2026-57170cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-57170