EUVD-2026-51625Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attacker needs no credentials (PR:N) but user must actively run Copier with a crafted URL (UI:R, AC:H); template hooks yield full code execution within unchanged scope (S:U, C:H/I:H/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing unsafe template features from a repository outside the trusted prefix to run after user interaction. This issue is fixed in version 9.17.0.
AnalysisAI
Copier CLI and library versions 9.5.0 through 9.16.0 expose a trust-prefix bypass that permits unsafe template features from untrusted repositories to execute on a victim's system after user interaction. The vulnerability arises because Copier's trusted-repository prefix check evaluates the raw percent-encoded URL string, while the underlying HTTP or Git transport subsequently decodes it - meaning a URL containing encoded dot-dot segments (e.g., %2e%2e) or encoded separators (%2f, %5c) can appear to match a trusted prefix while actually resolving to an entirely different, attacker-controlled repository. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code was identified in the provided data; the issue is patched in v9.17.0.
Technical ContextAI
Copier is a Python-based project-templating engine (CPE: cpe:2.3:a:copier-org:copier) that fetches templates from Git repositories and renders them using Jinja2, optionally executing task hooks. A 'trust' configuration allows designated repository prefixes to use unsafe template features (e.g., arbitrary code execution via tasks). The vulnerable normalization logic resided in copier/_settings.py in the _normalize() function: it ran posixpath.normpath() on the raw URL path without first percent-decoding it. Because RFC 3986 percent-encoding allows characters like . (%2e), / (%2f), and \ (%5c) to be encoded, a path such as /user/%2e%2e/evil/repo.git passes a prefix check for /user/ in encoded form but resolves to /evil/repo.git after the HTTP or Git transport decodes it. This is a classic CWE-22 (Path Traversal) instance: the application uses a representation of a path for a security decision that differs from the representation used for actual resource access. The fix (commit 7408f0d) adds a urllib.parse.unquote() call and backslash normalization before posixpath.normpath(), ensuring trust evaluation and transport resolution operate on the same decoded canonical path.
RemediationAI
The primary fix is to upgrade Copier to version 9.17.0 or later, which resolves the bypass by percent-decoding and backslash-normalizing URLs before the trust-prefix comparison. The patched release is confirmed at https://github.com/copier-org/copier/releases/tag/v9.17.0 and the fix commit is 7408f0d6287a7bf452715fd9f25dc54eaba3c295. If immediate upgrade is not possible, a targeted workaround is to ensure all entries in the trusted-prefix configuration use fully decoded, canonical URL forms and to audit any Copier invocations that accept externally-supplied template URLs. As a compensating control, restricting Copier usage to internally-hosted template repositories (where the URL is not attacker-influenced) eliminates the attack surface entirely; the trade-off is reduced flexibility in consuming third-party templates. There is no known workaround that preserves the trust-prefix feature while preventing the bypass on affected versions - upgrade is the only complete remediation.
Copier versions prior to 9.11.2 allow local attackers to write arbitrary files outside the intended project destination
Copier versions before 9.11.2 allow local attackers to read arbitrary files outside the template directory by exploiting
Trust-boundary bypass in Copier 9.5.0 through 9.15.1 lets an attacker-controlled template execute arbitrary commands wit
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today