Copier-org vulnerabilities
We track 4 vulnerabilities in Copier-org products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 31, 2026.
Latest Copier-org vulnerabilities
- 7.5 High severity
copier: Improper Limitation of a Pathname to a Restricted Directory
Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git tra
- 8.8 High severity
copier: Improper Limitation of a Pathname to a Restricted Directory
Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the `trust` setting's prefix match (`copier/_settings.py`) compares the template URL against a trusted prefix with a raw `str.startswith` and no path normalizati
- 7.1 High severity
copier: UNIX Symbolic Link (Symlink) Following
Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require pass
- 8.5 High severity
copier: Improper Limitation of a Pathname to a Restricted Directory
Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files because Copier exposes a few pathlib.Path objects in the Jinja context which have unconstrained I/O methods. This effective