HIGH8.4PyPI
GHSA-4q5v-7g7x-j79w· CVE-2026-46345, PYSEC-2026-2423compliance-trestle - jinja has an Arbitrary File Write via Path Traversal
Modified: 8/27/2026
package
PyPI/compliance-trestle
pkg:pypi/compliance-trestle
HIGHPyPI
GHSA-g3vg-vx23-3858· CVE-2026-45725, PYSEC-2026-2424compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal
Modified: 7/13/2026
HIGH7.8PyPI
GHSA-gg2g-p7xc-qqmm· CVE-2026-46439, PYSEC-2026-2425compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
Modified: 7/13/2026
HIGHPyPI
GHSA-h47f-gmjp-m7rr· CVE-2026-52776, PYSEC-2026-3659compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
Modified: 8/19/2026
HIGH7.8PyPI
GHSA-jw39-3688-r4rx· CVE-2026-54757, PYSEC-2026-3817Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
Modified: 9/10/2026
MEDIUMPyPI
GHSA-mj4x-vf5c-5xg8· CVE-2026-45774, PYSEC-2026-2426compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal
Modified: 7/13/2026
HIGH7.8PyPI
GHSA-mr95-65j8-9mxp· CVE-2026-57170Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)
Modified: 9/24/2026
HIGH8.4PyPI
GHSA-r4vp-3vw6-r2x5· CVE-2026-57171Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
Modified: 9/24/2026
MEDIUM6.7PyPI
GHSA-w76h-q7c6-jpjp· CVE-2026-46380, PYSEC-2026-2427compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem
Modified: 7/13/2026
HIGH8.4PyPI
PYSEC-2026-2423· CVE-2026-46345, GHSA-4q5v-7g7x-j79wcompliance-trestle - jinja has an Arbitrary File Write via Path Traversal
Modified: 7/13/2026
—PyPI
PYSEC-2026-2424· CVE-2026-45725, GHSA-g3vg-vx23-3858compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal
Modified: 7/13/2026
HIGH7.8PyPI
PYSEC-2026-2425· CVE-2026-46439, GHSA-gg2g-p7xc-qqmmcompliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)
Modified: 7/13/2026
—PyPI
PYSEC-2026-2426· CVE-2026-45774, GHSA-mj4x-vf5c-5xg8compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal
Modified: 7/13/2026
MEDIUM6.7PyPI
PYSEC-2026-2427· CVE-2026-46380, GHSA-w76h-q7c6-jpjpcompliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem
Modified: 7/13/2026
—PyPI
PYSEC-2026-3659· CVE-2026-52776, GHSA-h47f-gmjp-m7rrcompliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
Modified: 8/19/2026
HIGH7.8PyPI
PYSEC-2026-3817· CVE-2026-54757, GHSA-jw39-3688-r4rxTrestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
Modified: 9/10/2026