compliance-trestle has 8 CVEs on record. Disclosure cadence is accelerating: 8 in the last 90 days against 0 in the 90 before. The busiest recent month was August 2026 with 8. The median CVSS is 7.8 (high). None have a confirmed exploitation report. The most common weakness class is CWE-22 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 8 prev 0
Weakness classes
Products
- compliance-trestle 8
Worst active — by depth score
CVE-2026-46345High· 8.4compliance-trestle is a tooling platform for managing compliance as code46CVE-2026-57170High· 7.8Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents43CVE-2026-46439High· 7.8compliance-trestle is a tooling platform for managing compliance as code43CVE-2026-57171High· 7.7Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents42CVE-2026-52776HighCompliance-trestle (Trestle) is a tooling platform for managing compliance as code41
compliance-trestle vulnerabilities
CVEs affecting compliance-trestle, newest first. Open any entry for full detail, references, and exploit status.
8 CVEsRSS
CVE-2026-57171High· 7.7Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author comma…
CVE-2026-57170High· 7.8Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-par…
CVE-2026-52776HighCompliance-trestle (Trestle) is a tooling platform for managing compliance as code
Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request…
CVE-2026-46345High· 8.4compliance-trestle is a tooling platform for managing compliance as code
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace. The application does …
CVE-2026-46380Medium· 6.7compliance-trestle is a tooling platform for managing compliance as code
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an at…
CVE-2026-46439High· 7.8compliance-trestle is a tooling platform for managing compliance as code
compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection (SSTI) vulnerability exists in the `trestle author jinja` command. The command recursively…
CVE-2026-45774Mediumcompliance-trestle is a tooling platform for managing compliance as code
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the compliance-trestle library's profile import mechanism resolves `trestle://` URIs and relative file paths by joining them wi…
CVE-2026-45725Highcompliance-trestle is a tooling platform for managing compliance as code
compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) constructs the local cache fil…