Vulnerabilities for copier

First version without a known vulnerability: 9.15.2

Details

• GHSA-9gmc-jqmh-3rvm2026-08-19

  Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

  Fixed in: 9.15.2

• GHSA-hgjq-p8cr-gg4h2026-04-01

  Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode

  Fixed in: 9.14.1

• GHSA-85v3-4m8g-hrh62026-04-01

  Copier `_subdirectory` allows template root escape via parent-directory traversal

  Fixed in: 9.14.1

• GHSA-4fqp-r85r-hxqh2026-01-21

  Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true

  Fixed in: 9.11.2

• GHSA-xjhm-gp88-8pfx2026-01-21

  Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false

  Fixed in: 9.11.2

• GHSA-p7q8-grrj-3m8w2025-08-18

  Copier's safe template has filesystem write access outside destination path

  Fixed in: 9.9.1

• GHSA-3xw7-v6cj-5q8h2025-08-18

  Copier's safe template has arbitrary filesystem read/write access

  Fixed in: 9.9.1