HIGH GitHub
CVE-2026-53951
Copier has a trust-prefix bypass via path traversal that runs tasks unprompted
# Copier: trust-prefix bypass via path traversal runs tasks unprompted
### Summary
In copier `>= 9.5.0, <= 9.15.1`, the `trust` setting's prefix match
(`copier/_settings.py`) compares the template URL against a trusted prefix with
a raw `str.startswith` and **no path normalization**, while the URL *is*
normalized when the template is actually fetched (`Path.resolve()` for local
paths; libcurl dot-segment removal for `https`). A template reference that
textually starts with a trusted prefix but
Affected Products
- pip/copier >= 9.5.0, <= 9.15.1
References
- https://github.com/advisories/GHSA-9gmc-jqmh-3rvm
- https://github.com/copier-org/copier/security/advisories/GHSA-9gmc-jqmh-3rvm
- https://nvd.nist.gov/vuln/detail/CVE-2026-53951
- https://github.com/copier-org/copier/releases/tag/v9.15.2
This high severity vulnerability was published on 2026-08-19 via GitHub. Affected: pip/copier >= 9.5.0, <= 9.15.1.
vulnfeed aggregates 11644 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.