CVE-2026-57170 affects the Compliance-Trestle Python SDK used for managing OSCAL compliance documents. Versions prior to 3.12.4 and 4.0.0 through 4.0.3 contain a server-side template injection (SSTI) vulnerability in custom Jinja2 include tags (mdsection_include and md_clean_include). These tags re-parse included Markdown file content as Jinja2 template code in a non-sandboxed environment, enabling arbitrary code execution. The root cause is the use of a plain jinja2.Environment instead of a SandboxedEnvironment in Trestle/core/jinja/tags.py. Attacker-controlled OSCAL data fields such as control statements or component descriptions containing Jinja2 syntax can be injected and executed. Delimiter neutralization is only applied to parameter tables, leaving other prose fields vulnerable. The vulnerability has been fixed in version 4.1.0. Patches are available via two GitHub commits and a security advisory.