Attack Chain

1. Attacker places a malicious .md file containing a Jinja2 payload (e.g., {{ ... os.system(...) }}) into the Trestle workspace.
2. Attacker executes the trestle author jinja CLI command, targeting a legitimate template that utilizes the vulnerable {% md_clean_include %} or {% mdsection_include %} tags.
3. The Trestle engine loads the malicious file from the filesystem via FileSystemLoader.
4. The MDCleanInclude or MDSectionInclude tag handler processes the file content, extracting the Markdown body without sanitization.
5. The extracted content is passed as raw string input to the Parser constructor in trestle/core/jinja/tags.py.
6. The Parser.parse() method triggers the evaluation of the injected Jinja2 syntax within the template context.
7. The injected Python payload executes with the privileges of the Trestle process, leading to full Remote Code Execution (RCE) or sensitive data exfiltration.

Impact

Successful exploitation allows for arbitrary code execution on the system running the Trestle command. If used in automated CI/CD pipelines, this can result in the compromise of build environments, leakage of environment variables (e.g., API keys, AWS credentials), or lateral movement within the infrastructure.

Recommendation

1. Immediately restrict write access to all Trestle workspace directories to trusted users to prevent the introduction of malicious Markdown files.
2. Patch the application code by modifying trestle/core/jinja/tags.py to stop re-parsing Markdown content via Parser.parse(), replacing it with nodes.TemplateData as suggested by the security advisory.
3. Transition from jinja2.Environment to jinja2.sandbox.SandboxedEnvironment in trestle/core/commands/author/jinja.py to restrict access to sensitive Python object attributes.
4. Implement a pre-commit hook or CI scanning gate to audit all workspace files for Jinja2 syntax patterns and dangerous Python method calls (e.g., __globals__, os.system, subprocess).