Description
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints. Versions 3.12.2 and 4.0.3 fix the issue.
References5
- github.com/oscal-compass/compliance-trestle/commit/53de5e753328…
- github.com/oscal-compass/compliance-trestle/commit/5c65c5926fe7…
- github.com/oscal-compass/compliance-trestle/security/advisories…
- github.com/pypa/advisory-database/tree/main/vulns/compliance-tr…
- github.com/oscal-compass/compliance-trestle/security/advisories…
Metrics
- CVSS 3.1
-
6.7
MEDIUM
Score source: CNA
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N - EPSS — exploit probability
- 0% percentile: 4 · as of 12 November 2026
- CWE
- CWE-918
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.