- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 9 · 7 high, 2 medium
- Weekly downloads
- 19K
- Dependents
- 5
- Registry
- PyPI
Advisories 9
- CVE-2026-57171High 7.7
Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
Affected: fixed in 3.12.4; from 4.0.0, fixed in 4.1.0; fixed in 3.12.4; from 4.0.0, fixed in 4.1.0.
- CVE-2026-57170High 7.8
Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
Affected: fixed in 3.12.4; from 4.0.0, fixed in 4.1.0; fixed in 3.12.4; from 4.0.0, fixed in 4.1.0.
- CVE-2026-52776High 8.6
Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
Affected: fixed in 4.1.0.
- CVE-2026-54757High 7.8
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
Affected: fixed in 3.12.4; from 4.0.0, fixed in 4.1.0; fixed in 3.12.4; from 4.0.0, fixed in 4.1.0.
- CVE-2026-46345High 8.4
compliance-trestle - jinja has an Arbitrary File Write via Path Traversal
Affected: from 4.0.0, fixed in 4.0.3; fixed in 3.12.2; fixed in 3.12.2; from 4.0.0, fixed in 4.0.3.
- CVE-2026-46380Medium 6.7
compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem
Affected: from 4.0.0, fixed in 4.0.3; fixed in 3.12.2; fixed in 3.12.2; from 4.0.0, fixed in 4.0.3.
- CVE-2026-46439High 7.8
compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
Affected: fixed in 3.12.2; from 4.0.0, fixed in 4.0.3; fixed in 3.12.2; from 4.0.0, fixed in 4.0.3.
- CVE-2026-45774Medium 6.9
compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal
Affected: fixed in 3.12.2; from 4.0.0, fixed in 4.0.3; from 4.0.0, fixed in 4.0.3; fixed in 3.12.2.
- CVE-2026-45725High 7.1
compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal
Affected: from 4.0.0, fixed in 4.0.3; fixed in 3.12.2; fixed in 3.12.2; from 4.0.0, fixed in 4.0.3.