Description
Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files because Copier exposes a few pathlib.Path objects in the Jinja context which have unconstrained I/O methods. This effectively renders the security model w.r.t. filesystem access useless. This vulnerability is fixed in 9.9.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| copier-org | copier | < 9.9.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | copier | < 9.9.1 | 9.9.1 | GHSA-3xw7-v6cj-5q8h |