compliance-trestle SSRF Vulnerability Advisory (CVE-2026-6380)

Vulnerability Overview Vulnerability ID: PYSEC-2026-2427 Published Date: 2026-07-13T15:19:13.146702Z Modified Date: 2026-07-13T16:03:45.766002Z Aliases: CVE-2026-6380, GHSA-w76n-q7c6-jjpp Summary: compliance-trestle contains a Server-Side Request Forgery (SSRF) vulnerability in its Remote Fetching Subsystem. Details: Source code auditing revealed three significant security vulnerabilities in the core remote fetching subsystem of compliance-trestle. Affected Versions Package Name: compliance-trestle Ecosystem: PyPI Package URL: pkg:pypi/compliance-trestle Affected Versions: - Introduced version: 0 - Patched versions: 3.12.2, 4.0.0, 4.0.3 - List of specifically affected versions includes: 0.0.2, 0.0.3, 0.1.0, 0.1.1, 0.10.0, 0.11.0, 0.12.0, 0.13.0, 0.13.1, 0.14.0, 0.14.1, 0.14.2, 0.14.3, 0.14.4, 0.15.0, 0.15.1, 0.16.0, 0.17.0, 0.18.0, 0.18.1, 0.19.0, 0.2.0, 0.2.1, 0.2.2, 0.20.0, 0.21.0, 0.22.0, 0.22.1, 0.23.0, 0.24.0, 0.25.0, 0.25.1, 0.26.0, 0.27.0, 0.27.1, 0.27.2, 0.28.0, 0.28.1, 0.29.0, 0.3.0, 0.30.0, 0.31.0, 0.32.0, 0.32.1, 0.33.0, 0.34.0, 0.35.0, 0.36.0, 0.37.0, 0.4.0, 0.5.0, 0.6.0, 0.6.1, 0.6.2, 0.7.0, 0.7.1, 0.7.2, 0.8.0, 0.8.1, 0.8.2, 1.0.0rc0, 1.0.1, 1.0.2, 1.1.0, 1.2.0, 2.0.0, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.3.0, 2.3.1, 2.4.0, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 3.0.1, 3.1.0, 3.10.2, 3.10.3, 3.10.4, 3.11.0, 3.12.0, 3.12.1, 3.2.0, 3.3.0, 3.4.0, 3.5.0, 3.6.0, 3.7.0, 3.8.0, 3.8.1, 3.9.0, 3.9.1, 3.9.2, 3.9.3, 4.0.0, 4.0.1, 4.0.2 Remediation Patched versions: 3.12.2, 4.0.0, 4.0.3 References: - GitHub Advisory - NVD Detail - PyPI Project Additional Information CVSS Score: 3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:N POC Code or Exploit Code No POC code or exploit code is included in this entry.

Goal Reached Thanks to every supporter — we hit 100%!

compliance-trestle SSRF Vulnerability Advisory (CVE-2026-6380)

More from this source