Listen to this Post
CVE-2026-46439 affects the Trestle Jinja authoring path.
The original fix removed a recursive re-render loop in render_template.
That loop was in trestle/core/commands/author/jinja.py.
The fix was released for 3.12.2 and 4.0.3.
However, custom include tags remained unchanged in trestle/core/jinja/tags.py.
MDSectionInclude handles mdsection_include.
MDCleanInclude handles md_clean_include.
Both tags load an included markdown file.
They pass the included content back into Jinja2 Parser.
The call is Parser(self.environment, …).parse().
This re-parses included markdown as a Jinja2 template.
The parsed AST body is spliced into the host template.
Any {{ … }} or {% … %} in the included file becomes executable template code.
The fix in render_template does not stop this re-parse.
The re-parse happens at compile time inside the include tag.
The environment is a plain jinja2.Environment.
It is not jinja2.sandbox.SandboxedEnvironment.
Therefore Jinja SSTI gadget chains can reach OS command execution.
autoescape=True escapes HTML output only.
It does not constrain expression evaluation.
The data bridge is Trestle OSCAL-to-markdown generation.
SSPMarkdownWriter writes control statement prose.
It writes component implementation descriptions.
DocsControlWriter writes control section prose and part text.
Those writes are raw, without Jinja-delimiter escaping.
The {{ -> [[ neutralization exists only in parameter tables.
So OSCAL prose or descriptions can carry {{ }} into markdown.
That markdown is then included by a documented Trestle template pattern.
The include tag re-parses and evaluates the embedded expression.
This yields arbitrary code execution on the Trestle process.
The trust boundary is untrusted OSCAL data in an automated pipeline.
The impact is full RCE in a release patched for the parent CVE.
Remediation requires sandboxing, literal emission, or full neutralization.
DailyCVE Form:
Platform: Trestle
Version: 4.0.3
Vulnerability: Jinja2 SSTI RCE
Severity: Critical
date: 2026-04-26
Prediction: Expected: next release
(end of form)
What Undercode Say:
Analytics:
$ grep -R “Parser(self.environment” trestle/core/jinja/tags.py
$ sed -n ‘80,160p’ trestle/core/jinja/tags.py
$ grep -R “_create_jinja_environment” trestle/core/commands/author/jinja.py
$ grep -R “SandboxedEnvironment” trestle/core
$ grep -R “replace(‘{{‘, ‘\\[\\[‘” trestle/core/ssp_io.py
$ grep -R “new_line(prose)” trestle/core/docs_control_writer.py
trestle/core/jinja/tags.py
local_parser = Parser(self.environment, md_section.content.raw_text)
top_level_output = local_parser.parse()
return top_level_output.body
trestle/core/jinja/tags.py
local_parser = Parser(self.environment, content)
top_level_output = local_parser.parse()
return top_level_output.body
trestle/core/commands/author/jinja.py
return Environment(loader=FileSystemLoader(template_folder), extensions=extensions(), trim_blocks=True, autoescape=True)
trestle/core/ssp_io.py
line.replace(‘{{‘, ‘[[‘).replace(‘}}’, ‘]]’)
trestle/core/docs_control_writer.py
self._md_file.new_line(prose)
OSCAL prose field
{{ 77 }}
markdown include
{% md_clean_include ‘generated.md’ %}
observed result
49
Exploit: (Educational Purposes!)
Benign evaluation only
{{ 77 }}
Expected output
49
Do not use malicious gadget chains.
Protection: from this CVE
- Use jinja2.sandbox.SandboxedEnvironment for include re-parse.
- Emit included file content as literal text.
- Do not re-parse included markdown as Jinja2 template.
- Neutralize {{ and }} in all OSCAL prose, descriptions, part text.
- Patch MDSectionInclude and MDCleanInclude.
- Treat OSCAL input as untrusted in CI/CD.
Impact:
Arbitrary code execution on Trestle process or CI runner.
Full RCE under untrusted OSCAL data trust boundary.
Affects release patched for parent CVE-2026-46439.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
