Description
Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files because Copier exposes a few pathlib.Path objects in the Jinja context which have unconstrained I/O methods. This effectively renders the security model w.r.t. filesystem access useless. This vulnerability is fixed in 9.9.1.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://github.com/copier-org/copier/security/advisories/GHSA-3xw7-v6cj-5q8h
Scores
CVSS v4
8.5
EPSS
0.0005
EPSS Percentile
16.0%
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-22
Status
published
Products (2)
copier-org/copier
< 9.9.1
pypi/copier
0 - 9.9.1PyPI
Published
Aug 18, 2025
Tracked Since
Feb 18, 2026