CVE-2026-53951
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability in the Copier library (versions 9.5.0 through 9.15.1) allows bypassing the trust mechanism for templates. The prefix check uses raw `str.startswith` without path normalization, while template fetching normalizes the path, enabling `..` sequences to point to a different, attacker-controlled template. Consequently, code from `tasks`, `migrations`, or `jinja_extensions` executes without a trust prompt.
Risk Assessment
An attacker can achieve remote code execution on the victim's machine if the victim uses a trusted prefix and provides a crafted template URL. This could lead to full system compromise, data theft, or malware installation.
Recommendation
Immediately update Copier to version 9.15.2 or later. If updating is not possible, temporarily avoid using trusted prefixes or manually verify each template before use.
Other vulnerabilities in Copier
See all- CVE-2026-62999High
Copier versions 9.5.0 through 9.16.0 contain a vulnerability that allows bypassing the trusted repository prefix. Percent-encoded path segments or separators in a template URL can match a configured trusted prefix before decoding by the HTTP server or Git transport, enabling unsafe template features from a repository outside the trusted prefix after user interaction.
- CVE-2026-34730Medium
Copier before version 9.14.1 has a vulnerability in the _external_data feature that allows a template to load YAML files from template-controlled paths. A malicious template can read local YAML-parseable files accessible to the user and expose their contents in rendered output.
- CVE-2026-34726Medium
Copier before version 9.14.1 accepts parent-directory traversal (..) in the _subdirectory setting, allowing a template to escape its own directory and render files from the parent directory without the --UNSAFE flag.
Original NVD description (English source)
Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the `trust` setting's prefix match (`copier/_settings.py`) compares the template URL against a trusted prefix with a raw `str.startswith` and no path normalization, while the URL is normalized when the template is actually fetched (`Path.resolve()` for local paths; libcurl dot-segment removal for `https`). A template reference that textually starts with a trusted prefix but contains `..` is therefore granted trust yet resolves to a different, attacker-controlled template, whose `tasks` / `migrations` / `jinja_extensions` then run without the `--trust` prompt — arbitrary command execution. Version 9.15.2 patches the issue.