{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/trestle/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["trestle"],"_cs_severities":["high"],"_cs_tags":["ssti","rce","python","jinja2"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eTrestle contains multiple Server-Side Template Injection (SSTI) vulnerabilities within its Jinja2 rendering pipeline. The application processes Markdown files and other data sources using custom Jinja2 extensions (\u003ccode\u003eMDCleanInclude\u003c/code\u003e and \u003ccode\u003eMDSectionInclude\u003c/code\u003e). These extensions improperly treat untrusted content as Jinja2 template source code by passing it directly to the \u003ccode\u003ejinja2.Parser\u003c/code\u003e object without adequate sanitization or sandboxing. Because the environment utilizes a standard \u003ccode\u003ejinja2.Environment\u003c/code\u003e rather than a \u003ccode\u003eSandboxedEnvironment\u003c/code\u003e, attackers can inject malicious Jinja2 expressions, such as object traversal payloads (e.g., \u003ccode\u003e__class__.__mro__\u003c/code\u003e, \u003ccode\u003e__globals__\u003c/code\u003e), to achieve arbitrary command execution via Python's \u003ccode\u003eos.system\u003c/code\u003e or \u003ccode\u003esubprocess\u003c/code\u003e modules. This pattern exists within \u003ccode\u003etrestle/core/jinja/tags.py\u003c/code\u003e and is triggered whenever a user-provided or workspace-modified Markdown file is processed by the Trestle authoring commands.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker places a malicious \u003ccode\u003e.md\u003c/code\u003e file containing a Jinja2 payload (e.g., \u003ccode\u003e{{ ... os.system(...) }}\u003c/code\u003e) into the Trestle workspace.\u003c/li\u003e\n\u003cli\u003eAttacker executes the \u003ccode\u003etrestle author jinja\u003c/code\u003e CLI command, targeting a legitimate template that utilizes the vulnerable \u003ccode\u003e{% md_clean_include %}\u003c/code\u003e or \u003ccode\u003e{% mdsection_include %}\u003c/code\u003e tags.\u003c/li\u003e\n\u003cli\u003eThe Trestle engine loads the malicious file from the filesystem via \u003ccode\u003eFileSystemLoader\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eMDCleanInclude\u003c/code\u003e or \u003ccode\u003eMDSectionInclude\u003c/code\u003e tag handler processes the file content, extracting the Markdown body without sanitization.\u003c/li\u003e\n\u003cli\u003eThe extracted content is passed as raw string input to the \u003ccode\u003eParser\u003c/code\u003e constructor in \u003ccode\u003etrestle/core/jinja/tags.py\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eParser.parse()\u003c/code\u003e method triggers the evaluation of the injected Jinja2 syntax within the template context.\u003c/li\u003e\n\u003cli\u003eThe injected Python payload executes with the privileges of the Trestle process, leading to full Remote Code Execution (RCE) or sensitive data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the system running the Trestle command. If used in automated CI/CD pipelines, this can result in the compromise of build environments, leakage of environment variables (e.g., API keys, AWS credentials), or lateral movement within the infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately restrict write access to all Trestle workspace directories to trusted users to prevent the introduction of malicious Markdown files.\u003c/li\u003e\n\u003cli\u003ePatch the application code by modifying \u003ccode\u003etrestle/core/jinja/tags.py\u003c/code\u003e to stop re-parsing Markdown content via \u003ccode\u003eParser.parse()\u003c/code\u003e, replacing it with \u003ccode\u003enodes.TemplateData\u003c/code\u003e as suggested by the security advisory.\u003c/li\u003e\n\u003cli\u003eTransition from \u003ccode\u003ejinja2.Environment\u003c/code\u003e to \u003ccode\u003ejinja2.sandbox.SandboxedEnvironment\u003c/code\u003e in \u003ccode\u003etrestle/core/commands/author/jinja.py\u003c/code\u003e to restrict access to sensitive Python object attributes.\u003c/li\u003e\n\u003cli\u003eImplement a pre-commit hook or CI scanning gate to audit all workspace files for Jinja2 syntax patterns and dangerous Python method calls (e.g., \u003ccode\u003e__globals__\u003c/code\u003e, \u003ccode\u003eos.system\u003c/code\u003e, \u003ccode\u003esubprocess\u003c/code\u003e).\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-28T21:19:10Z","date_published":"2026-08-28T21:19:10Z","id":"https://feed.craftedsignal.io/briefs/2026-08-trestle-ssti/","summary":"The Trestle command-line tool is vulnerable to Server-Side Template Injection (SSTI) due to the unsafe re-evaluation of untrusted Markdown content as Jinja2 template code.","title":"Trestle Server-Side Template Injection via Custom Jinja2 Extensions","url":"https://feed.craftedsignal.io/briefs/2026-08-trestle-ssti/"}],"language":"en","title":"CraftedSignal Threat Feed - Trestle","version":"https://jsonfeed.org/version/1.1"}