EUVD-2026-42309
GHSA-9gmc-jqmh-3rvm
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local CLI execution (AV:L) needing an operator to run Copier (UI:R) with a pre-set trusted prefix and a crafted traversal path (AC:H); code execution as the user yields C/I/A:H, scope unchanged.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the trust setting's prefix match (copier/_settings.py) compares the template URL against a trusted prefix with a raw str.startswith and no path normalization, while the URL is normalized when the template is actually fetched (Path.resolve() for local paths; libcurl dot-segment removal for https). A template reference that textually starts with a trusted prefix but contains .. is therefore granted trust yet resolves to a different, attacker-controlled template, whose tasks / migrations / jinja_extensions then run without the --trust prompt - arbitrary command execution. Version 9.15.2 patches the issue.
AnalysisAI
Trust-boundary bypass in Copier 9.5.0 through 9.15.1 lets an attacker-controlled template execute arbitrary commands without the usual --trust confirmation. The flaw stems from the trust prefix check using a raw str.startswith on the un-normalized template URL, so a reference that textually begins with a trusted prefix but contains '..' is granted trust while actually resolving to a different template whose tasks/migrations/jinja_extensions then run. No public exploit identified at time of analysis, and it is not in CISA KEV; fixed in 9.15.2.
Technical ContextAI
Copier is a Python library/CLI for scaffolding projects from templates (a peer of cookiecutter). When rendering, template-supplied hooks - tasks, migrations, and jinja_extensions - can run shell/Python code, so Copier gates them behind an interactive --trust prompt unless the template's source matches an operator-configured trusted prefix. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): in copier/_settings.py the prefix comparison is a naive lexical str.startswith with no path normalization, whereas the fetch path normalizes the URL (Path.resolve() for local filesystem sources, libcurl dot-segment removal for https). This normalization mismatch means the string that is trusted and the location that is fetched can diverge once '..' segments are present. The single affected package is cpe:2.3:a:copier-org:copier.
RemediationAI
Vendor-released patch: 9.15.2 - upgrade Copier to 9.15.2 or later (e.g. pip install --upgrade 'copier>=9.15.2') as the primary fix, per GHSA-9gmc-jqmh-3rvm and https://github.com/copier-org/copier/releases/tag/v9.15.2. If you cannot upgrade immediately, avoid configuring trusted prefixes in Copier settings so that every template again requires the interactive --trust confirmation (trade-off: reintroduces manual prompts for legitimate automated pipelines), and never pass externally-influenced or user-supplied template references to Copier runs that rely on trust prefixes. Additionally, only run Copier against templates from sources you fully control and inspect template references for '..' or other traversal segments before execution; treat CI/CD template resolution as untrusted input.
Copier versions prior to 9.11.2 allow local attackers to write arbitrary files outside the intended project destination
Copier versions before 9.11.2 allow local attackers to read arbitrary files outside the template directory by exploiting
Copier CLI and library versions 9.5.0 through 9.16.0 expose a trust-prefix bypass that permits unsafe template features
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today