[ Vendor · 2 CVEs ]
oscal-compass
CVEs affecting oscal-compass published in the last 30 days, plus any oscal-compass CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-57171 | 25 Aug 2026 | CVSS 7.7 | Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions… | Fix |
| CVE-2026-57170 | 25 Aug 2026 | CVSS 7.8 | Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0… | Fix |