CVE-2026-46345
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
compliance-trestle before versions 3.12.2 and 4.0.3 has a vulnerability in the `-o/--output` argument in `trestle author jinja` that allows writing files outside the intended workspace. The application does not properly validate `../`, `..\`, or absolute paths, allowing arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue.
Risk Assessment
An attacker can write arbitrary files on the system, potentially leading to full control of the application or system.
Recommendation
Upgrade compliance-trestle to version 3.12.3 or 4.0.3 (or later).
Original NVD description (English source)
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace. The application does not properly validate, `../`, `..\`, or absolute paths. This allows arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue.