CVE-2026-53951: Copier trust-prefix bypass via path traversal in trusted template URLs

CVE-2026-53951 · Severity: high · CVSS 4 · Published 2026-07-08

Copier is a Python tool used for creating and updating projects from templates. An attacker who controls a project's configuration can craft a malicious template URL containing path-traversal sequences (e.g., `..`) that bypasses the trust settings intended to prevent unsafe templates from running. This allows arbitrary commands to execute via template tasks without user confirmation, compromising the integrity and security of projects being created or updated.

Technologies: Copier-Org Copier, copier (PyPI). Vendors: Copier-Org, PyPI.

Quick answers

Is CVE-2026-53951 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53951 being exploited in the wild.
How severe is CVE-2026-53951?
High severity, with a CVSS score of 4, published 8 July 2026.
Which products and versions are affected?
Copier-Org Copier >= 9.5.0, < 9.15.2, >=9.5.0, <=9.15.1; copier (PyPI) ECOSYSTEM:introduced=9.5.0,fixed=9.15.2.
Is there a fix for CVE-2026-53951?
Yes. copier (PyPI): upgrade to 9.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53951 attacked?
It is attacked with local access or over the network.
Am I affected by CVE-2026-53951?
Check whether you run Copier-Org Copier or copier (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • copier (PyPI): upgrade to 9.15.2 or later
    pip install "copier>=9.15.2"

Technical details

The vulnerability is a path-traversal authorization bypass in the trust-prefix matching logic (copier/_settings.py:141-146). The code uses raw `str.startswith()` to compare template URLs against trusted prefixes, but the _normalize() function only expands `~` and does not resolve `..` or `.` segments. Meanwhile, when the template is actually fetched, the URL is normalized via `Path.resolve()` (local paths) or libcurl dot-segment removal (HTTPS). An attacker-controlled URL with embedded `..` (e.g., `/trusted_prefix/../attacker/template`) passes the trust check because it textually starts with the trusted prefix, but resolves to a different location. Since the untrusted-template gate in copier/_main.py:293 returns early when trust matches, the malicious template's tasks, migrations, and jinja_extensions execute without prompting. This is most severe on `copier update`, which reads the template URL from the project's `.copier-answers.yml`, meaning an attacker who distributes a project controls the URL. The fix requires normalizing both sides of the comparison before the prefix test, using `Path(t).resolve()` and segment containment checks (already used elsewhere in the codebase).

Affected products

  • copier-org copier >=9.5.0, <=9.15.1

Identifiers

  • CVE-2026-53951
  • GHSA-9gmc-jqmh-3rvm
  • PYSEC-2026-3818

Timeline

  • 2026-08-19: disclosed
  • 2026-06-13: patched: Version 9.15.2 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.