CVE-2026-53951 Details
Description
Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the `trust` setting's prefix match (`copier/_settings.py`) compares the template URL against a trusted prefix with a raw `str.startswith` and no path normalization, while the URL is normalized when the template is actually fetched (`Path.resolve()` for local paths; libcurl dot-segment removal for `https`). A template reference that textually starts with a trusted prefix but contains `..` is therefore granted trust yet resolves to a different, attacker-controlled template, whose `tasks` / `migrations` / `jinja_extensions` then run without the `--trust` prompt — arbitrary command execution. Version 9.15.2 patches the issue.
A vulnerability exists in the Copier library and CLI application, specifically in versions 9.5.0 through 9.15.1. The issue arises in the 'trust' setting's prefix match, where the template URL is compared against a trusted prefix using a raw 'str.startswith' method without proper path normalization. While the URL is normalized when the template is fetched, this discrepancy creates a trust bypass. A template reference that appears to start with a trusted prefix but contains '..' can be exploited to reference an attacker-controlled template. When this template is executed, it runs tasks, migrations, or Jinja extensions without the usual trust prompt, leading to arbitrary command execution.
Users can update to Copier version 9.15.2, which patches the vulnerability by normalizing both sides of the trust comparison and rejecting URLs with '..' segments after the scheme and host.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/copier-org/copier/security/advisories/GHSA-9gmc-jqmh-3rvm | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/copier-org/copier/releases/tag/v9.15.2 | [email protected] | Release NotesVendor |
| https://github.com/copier-org/copier/security/advisories/GHSA-9gmc-jqmh-3rvm | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| copier-org copier | >= 9.5.0, <= 9.15.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |