Is CVE-2026-46439 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46439 being exploited in the wild.

How severe is CVE-2026-46439?

High severity, with a CVSS score of 7.8, published 28 May 2026.

Which products and versions are affected?

oscal-compass compliance-trestle = 4.0.0, < 4.0.3.

Is there a fix for CVE-2026-46439?

A patch was published on 2026-05-28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46439 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-46439?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46439: oscal-compass compliance-trestle SSTI in trestle author jinja

Q: Is there a fix for CVE-2026-46439?

A patch was published on 2026-05-28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46439 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-46439?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46439 · Severity: high · CVSS 7.8 · Published 2026-05-28

Compliance-trestle, a tool used to manage compliance artifacts, is vulnerable to a security flaw that allows attackers to execute malicious commands. By including specially crafted text in data files like System Security Plans (SSPs), an attacker can take control of the system running the tool, such as an automated build server or a developer's workstation. This could lead to the theft of sensitive data or a complete compromise of the environment where compliance documents are generated.

Quick answers

Is CVE-2026-46439 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46439 being exploited in the wild.
How severe is CVE-2026-46439?: High severity, with a CVSS score of 7.8, published 28 May 2026.
Which products and versions are affected?: oscal-compass compliance-trestle <= 3.12.1, >= 4.0.0, < 4.0.3.
Is there a fix for CVE-2026-46439?: A patch was published on 2026-05-28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46439 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-46439?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Template Injection (SSTI) vulnerability exists in the 'trestle author jinja' command of compliance-trestle. The root cause is the recursive re-rendering of template output in 'trestle/core/commands/author/jinja.py' using a non-sandboxed Jinja2 environment. If a trusted template renders attacker-controlled data (such as an OSCAL SSP document or Lookup Table) containing Jinja2 expressions, those expressions are evaluated as code in subsequent recursion passes. An attacker can exploit this to achieve arbitrary command execution with the privileges of the process. The vulnerability is patched in versions 3.12.2 and 4.0.3.

Affected products

oscal-compass compliance-trestle <= 3.12.1, >= 4.0.0, < 4.0.3

Identifiers

CVE-2026-46439
GHSA-gg2g-p7xc-qqmm

Timeline

2026-05-27: disclosed
2026-05-28: advisory: GitHub Advisory GHSA-gg2g-p7xc-qqmm published
2026-05-28: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.