Skip to content
OpenAdvisories

Vendor

oscal-compass

9 known vulnerabilities.

Products

compliance-trestle 9
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.7
    CVE-2026-46380

    compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

    compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Serv…

    oscal-compass compliance-trestle compliance-trestle PyPI
  • Medium 6.9
    CVE-2026-45774

    compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal

    compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the compliance-trestle library's profile import mechanism resolves `trestle://` URIs and relative file paths by joining them with `trestle_root` and …

    oscal-compass compliance-trestle compliance-trestle PyPI