CVE-2026-34730
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Copier before version 9.14.1 has a vulnerability in the _external_data feature that allows a template to load YAML files from template-controlled paths. A malicious template can read local YAML-parseable files accessible to the user and expose their contents in rendered output.
Risk Assessment
The organization may be at risk of sensitive data leakage if users run untrusted Copier templates. Attackers could read configuration files or sensitive data.
Recommendation
Update Copier to version 9.14.1. Avoid using untrusted templates.
Original NVD description (English source)
Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data feature allows a template to load YAML files using template-controlled paths. If untrusted templates are in scope, a malicious template can read attacker-chosen YAML-parseable local files that are accessible to the user running Copier and expose their contents in rendered output. This issue has been patched in version 9.14.1.