Skip to content
OpenAdvisories

Package · PyPI

copier

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2026-53951

    Copier: trust-prefix bypass via path traversal runs tasks unprompted

    Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the `trust` setting's prefix match (`copier/_settings.py`) compares the template URL against a trusted prefix with a raw `str.startswith` and no path normalizat…

    copier-org copier copier PyPI
  • High 8.5
    CVE-2025-55201

    Copier safe template has arbitrary filesystem read/write access

    Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files because Copier exposes a few pathlib.Path objects in the Jinja context which have unconstrained I/O methods. This effectiv…

    copier-org copier copier PyPI