copier-org/copier Security Advisories | GitStock

high2026-08-19

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

GHSA-9gmc-jqmh-3rvm · CVE-2026-53951

medium2026-04-01

Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode

GHSA-hgjq-p8cr-gg4h · CVE-2026-34730

medium2026-04-01

Copier `_subdirectory` allows template root escape via parent-directory traversal

GHSA-85v3-4m8g-hrh6 · CVE-2026-34726

medium2026-01-21

Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true

GHSA-4fqp-r85r-hxqh · CVE-2026-23986

medium2026-01-21

Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false

GHSA-xjhm-gp88-8pfx · CVE-2026-23968

medium2025-08-18

Copier's safe template has filesystem write access outside destination path

GHSA-p7q8-grrj-3m8w · CVE-2025-55214

high2025-08-18

Copier's safe template has arbitrary filesystem read/write access

GHSA-3xw7-v6cj-5q8h · CVE-2025-55201