THREAT OPS › Threat News › [NVD] CVE-2026-46439 (HIGH 7.8) — compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection (SSTI) vulnerability exists in the `trestle author jinja` command. The command recursively evaluates rendered templates, allowing an
[NVD] CVE-2026-46439 (HIGH 7.8) — compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection (SSTI) vulnerability exists in the `trestle author jinja` command. The command recursively evaluates rendered templates, allowing an
CVE-2026-46439 CVSS: 7.8 HIGH Published: 2026-08-14T17:18:14.853
compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection (SSTI) vulnerability exists in the `trestle author jinja` command. The command recursively evaluates rendered templates, allowing an attacker to achieve arbitrary command execution with p
MITRE ATT&CK techniques
- Template InjectionT1221
Indicators of compromise
- CVE-2026-46439cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-46439