Vulnerabilities in oscal-compass
9 resultsCVE-2026-45774MEDIUMcompliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path TraversalEPSS 0.5%CVE-2026-45725HIGHcompliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path TraversalEPSS 0.5%CVE-2026-52776HIGHTrestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0EPSS 0.4%CVE-2026-54757HIGHTrestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted DataEPSS 0.4%CVE-2026-46439HIGHcompliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)EPSS 0.3%CVE-2026-57170HIGHTrestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)EPSS 0.2%CVE-2026-57171HIGHTrestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)EPSS 0.2%CVE-2026-46345HIGHcompliance-trestle - jinja has an Arbitrary File Write via Path TraversalEPSS 0.2%CVE-2026-46380MEDIUMcompliance-trestle Vulnerable to SSRF in Remote Fetching SubsystemEPSS 0.1%