01 Record

CVE-2026-46439

compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)

HighPUBLISHEDCNA: GitHub_M

Base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

02 Description

compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)

Published: 2026-08-14 16:08Z2 HR AGO
Last updated: 2026-08-14 16:34Z2 HR AGO
Reserved: 2026-05-13
Assigning CNA: GitHub_M
Record state: PUBLISHED
Severity: High (CVSS 7.8)
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses: CWE-94 CWE-1336
SSVC decision: ExploitationpocAutomatablenoTechnical Impacttotal
Data version: 5.2
Document digest: 89a9f63647c6b172947cef25a676781967f9bfc8dbc8a5e88e2f14ee0be3b54e

VendorProductVersionsPlatforms

oscal-compasscompliance-trestle< 3.12.2, >= 4.0.0, < 4.0.3—