The compliance-trestle platform is vulnerable to SSRF and improper input validation, which may allow an authenticated attacker to compromise internal system resources.

This vulnerability involves an incomplete list of disallowed inputs and Server-Side Request Forgery (CWE-184 and CWE-918). It requires low privileges for exploitation and allows an authenticated user to perform unauthorized requests from the server environment.

Successful exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive data or the ability to probe internal network segments. Given the CVSS score of 8.6, this represents a significant risk to the confidentiality and integrity of the compliance-as-code infrastructure.

Immediate Action: Upgrade to version 3.12.4 or 4.1.0 or newer to resolve the identified input validation and SSRF flaws.

Proactive Monitoring: Monitor application logs for unusual outbound network connections or requests targeting internal metadata services or local loopback addresses.

Compensating Controls: Implement strict egress filtering at the network level to prevent the application server from initiating unauthorized connections to sensitive internal endpoints.

Public Exploit Available: No (exploit_available: false)

The high severity of this vulnerability necessitates immediate attention. Administrators should prioritize patching compliance-trestle to the latest versions to neutralize the SSRF and input validation risks, thereby preventing potential lateral movement or unauthorized data extraction within the compliance environment.