CO
Product
copier
8
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 4Medium 4Low 0
Watch
Add copier to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-53951 | 8.8 | Jul 8 | Copier: trust-prefix bypass via path traversal runs tasks unprompted Affected: >= 9.5.0, < 9.15.2 |
| CVE-2025-55201 | 8.5 | Aug 18 | Copier safe template has arbitrary filesystem read/write access Affected: < 9.9.1 |
| CVE-2026-62999 | 7.5 | Jul 31 | Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass) Affected: >= 9.5.0, <= 9.16.0 |
| CVE-2026-23986 | 7.1 | Jan 21 | Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true Affected: < 9.11.2 |
| CVE-2025-55214 | 6.9 | Aug 18 | Copier safe template has filesystem write access outside destination path Affected: >= 7.1.0, < 9.9.1 |
| CVE-2026-34730 | 5.5 | Apr 2 | Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode Affected: < 9.14.1 |
| CVE-2026-23968 | 5.5 | Jan 21 | Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false Affected: < 9.11.2 |
| CVE-2026-34726 | 4.4 | Apr 2 | Copier `_subdirectory` allows template root escape via parent-directory traversal Affected: < 9.14.1 |
Showing 8