Description
compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) constructs the local cache file path from the URL path component without sanitizing path traversal sequences (`../`). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location outside the intended cache directory, enabling arbitrary file write with attacker-controlled content to the filesystem. Versions 3.12.3 and 4.0.3 patch the issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
oscal-compass compliance-trestle
< 3.12.2affected>= 4.0.0, < 4.0.3affected
References
- https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-g3vg-vx23-3858 ↗
- https://github.com/oscal-compass/compliance-trestle/commit/89f4e53d159e8ff901da4d7c3b51c9556bd32ec0 ↗
- https://github.com/oscal-compass/compliance-trestle/commit/9abc492329fcc8d0557182317de9bde854385da3 ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/compliance-trestle/PYSEC-2026-2424.yaml ↗