CVE-2026-57171

An IMPORTANT severity flaw was found in Compliance-trestle (Trestle), an upstream Python SDK and command-line tool for managing OSCAL compliance documents. The catalog-generate, profile-generate, and ssp-generate author commands join the user-supplied -o/--output argument onto the Trestle workspace root without path-traversal validation, so an output value containing an absolute path or traversal sequences escapes the workspace and writes generated Markdown files to an attacker-chosen location as the invoking process owner. The security boundary is crossed when a trusted CI job, automation pipeline, shared service, or wrapper derives the output argument from repository-controlled, tenant-controlled, or otherwise untrusted data while expecting the output to remain inside the workspace; the attacker needs no local shell access, only influence over the data mapped into the output argument. When --force-overwrite is used, the selected output directory is recursively deleted before generation, extending the impact to destruction of an attacker-chosen directory tree and to possible indirect code execution by overwriting files a pipeline later runs. Red Hat rated this flaw IMPORTANT with a CVSS 3.1 base score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), a conservative variant of the upstream advisory's 8.4 score that reflects the demonstrated write/overwrite primitive rather than information disclosure. The Red Hat products evaluated for this flaw (the openshift-compliance-content-rhel8 container image and the scap-security-guide package) were assessed by the responsible product teams as not affected because the vulnerable compliance-trestle component is not present in the shipped artifacts, so no Red Hat fix is required.