CVE-2026-57171: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in oscal-compass compliance-trestle

Compliance-trestle is a Python SDK and CLI tool for managing OSCAL compliance documents. In affected versions, the catalog-generate, profile-generate, and ssp-generate commands improperly validate the user-supplied output path, relying only on a task-name-collision check instead of a full path traversal validation. This allows absolute paths or paths with traversal sequences to escape the workspace boundary and write files arbitrarily on the filesystem with the invoking process's privileges. When the --force-overwrite flag is used, the vulnerability extends to recursive deletion of attacker-controlled directories, which can lead to indirect code execution by overwriting files used later in a pipeline. The vulnerability is addressed in versions 3.12.4 and 4.1.0.

An attacker who can influence the output path argument can write arbitrary files outside the intended workspace, potentially overwriting critical files. The use of --force-overwrite exacerbates the impact by allowing recursive deletion of directories chosen by the attacker, which can facilitate indirect code execution in CI/CD pipelines or shared services. This compromises the integrity and availability of the system where compliance-trestle runs, especially in automated or multi-tenant environments.

Upgrade compliance-trestle to version 3.12.4 or later, or 4.1.0 or later, where the vulnerability is fixed. Until upgraded, avoid using untrusted input for the output path argument in the affected commands and avoid using the --force-overwrite option with untrusted data. Patch status is not explicitly stated in the vendor advisory, but the fix is included in the specified versions.