Executive brief
Copier is a tool used by developers to generate and update project structures from templates. A security flaw allows a specially crafted template URL to bypass "trusted repository" security checks by using encoded characters (like %2e%2e for ".." ). If a user is tricked into using or updating a project from such a URL, the tool may automatically execute malicious scripts or commands embedded in the untrusted template without the user's explicit permission.
Technical details
A path traversal vulnerability exists in Copier's trust-prefix validation logic due to incorrect behavior order (validate before canonicalize). The application compares a template URL against a list of trusted prefixes before decoding percent-encoded characters (e.g., '%2e%2e' for '..'). Consequently, a malicious URL can appear to reside within a trusted prefix during the security check, but resolve to an untrusted external repository when fetched by the Git transport or HTTP server. An attacker can leverage this to execute unsafe template features, such as arbitrary shell tasks or Jinja2 extensions, with the permissions of the Copier process. This requires the user to interact with a crafted URL or update a project containing a malicious source path in its configuration. The issue is resolved in version 9.17.0 by decoding URL paths before resolving dot segments during the trust check.
Affected products
- copier-org Copier >= 9.5.0, <= 9.16.0
Timeline
- 2026-07-13: patched: Version 9.17.0 released
- 2026-07-15: disclosed: GitHub Security Advisory published
- 2026-07-31: advisory: NVD published CVE-2026-62999