CVE-2026-62999
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Copier versions 9.5.0 through 9.16.0 contain a vulnerability that allows bypassing the trusted repository prefix. Percent-encoded path segments or separators in a template URL can match a configured trusted prefix before decoding by the HTTP server or Git transport, enabling unsafe template features from a repository outside the trusted prefix after user interaction.
Risk Assessment
An attacker can trick a user into using a template from an unsafe repository, potentially leading to arbitrary code execution or data theft. The risk requires user interaction.
Recommendation
Update Copier to version 9.17.0 or later. Until then, avoid using templates from untrusted sources and verify template URLs.
Other vulnerabilities in Copier
See all- CVE-2026-53951High
A vulnerability in the Copier library (versions 9.5.0 through 9.15.1) allows bypassing the trust mechanism for templates. The prefix check uses raw `str.startswith` without path normalization, while template fetching normalizes the path, enabling `..` sequences to point to a different, attacker-controlled template. Consequently, code from `tasks`, `migrations`, or `jinja_extensions` executes without a trust prompt.
- CVE-2026-34730Medium
Copier before version 9.14.1 has a vulnerability in the _external_data feature that allows a template to load YAML files from template-controlled paths. A malicious template can read local YAML-parseable files accessible to the user and expose their contents in rendered output.
- CVE-2026-34726Medium
Copier before version 9.14.1 accepts parent-directory traversal (..) in the _subdirectory setting, allowing a template to escape its own directory and render files from the parent directory without the --UNSAFE flag.
Original NVD description (English source)
Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing unsafe template features from a repository outside the trusted prefix to run after user interaction. This issue is fixed in version 9.17.0.