PyPI/compliance-trestle CVE-2026-54757: high 7.8, EPSS 0.36%

Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Action: Upgrade compliance-trestle to 3.12.4 or later.

pip install compliance-trestle==3.12.4

pip install compliance-trestle==4.1.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-3817
• https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-jw39-3688-r4rx
• https://nvd.nist.gov/vuln/detail/CVE-2026-54757
• https://github.com/oscal-compass/compliance-trestle/pull/2257
• https://github.com/oscal-compass/compliance-trestle/commit/0f82d19bd42f9cc0f1b3acd7fc3f6dafe3b6ae10
• https://github.com/oscal-compass/compliance-trestle/commit/5335ff873a2a68eb7de43df029bea09cadff22fd
• https://github.com/oscal-compass/compliance-trestle
• https://github.com/oscal-compass/compliance-trestle/releases/tag/v3.12.4
• https://github.com/oscal-compass/compliance-trestle/releases/tag/v4.1.0
• https://pypi.org/project/compliance-trestle
• https://github.com/advisories/GHSA-jw39-3688-r4rx

CVE-2026-54757 · published 2026-09-10T09:44:57.988332Z · modified 2026-09-10T12:15:05.048979340Z · JSON