Skip to content
OpenAdvisories

Vendor

copier-org

8 known vulnerabilities.

Products

copier 8
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-62999

    Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

    Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git tr…

    copier-org copier
  • High 8.8
    CVE-2026-53951

    Copier: trust-prefix bypass via path traversal runs tasks unprompted

    Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the `trust` setting's prefix match (`copier/_settings.py`) compares the template URL against a trusted prefix with a raw `str.startswith` and no path normalizat…

    copier-org copier copier PyPI
  • High 8.5
    CVE-2025-55201

    Copier safe template has arbitrary filesystem read/write access

    Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files because Copier exposes a few pathlib.Path objects in the Jinja context which have unconstrained I/O methods. This effectiv…

    copier-org copier copier PyPI