CVE-2026-53951: CVE-2026-53951: Trust-Prefix Bypass via Path Traversal leading to Remote Code Execution in Copier

CVE-2026-53951: Trust-Prefix Bypass via Path Traversal leading to Remote Code Execution in Copier

Vulnerability ID: CVE-2026-53951
CVSS Score: 8.8
Published: 2026-08-19

A security vulnerability in Copier versions 9.5.0 through 9.15.1 allows unauthenticated remote code execution via crafted HTTP requests or local paths containing traversal sequences. The trust-evaluation mechanism compares target repository paths or URLs against trusted prefixes using unnormalized string comparison, while the subsequent fetching mechanism normalizes the path before cloning. Attackers can exploit this asymmetry to bypass security warning prompts and execute arbitrary commands under the local user context.

TL;DR

Copier's template trust validation fails to normalize repository paths prior to evaluating prefix trust lists, permitting attackers to bypass safety verification prompts and execute arbitrary lifecycle tasks through path traversal payloads.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-22, CWE-94
• Attack Vector: Local / Remote Fetching
• CVSS Base Score: 8.8 (High)
• Exploit Status: poc
• KEV Status: Not Listed
• Affected Versions: >= 9.5.0, <= 9.15.1

Affected Systems

• Copier Library and CLI Application
• Copier: >= 9.5.0, <= 9.15.1 (Fixed in: 9.15.2)

Mitigation Strategies

• Upgrade Copier to version 9.15.2 or above.
• Clear or comment out configured trusted_prefixes in configuration files to force prompt checks on all templates.
• Run template updates only with explicit user confirmation in non-automated environments.

Remediation Steps:

1. Update the Copier CLI tool using pip: pip install --upgrade copier.
2. Verify the installed version: copier --version.
3. Audit active configurations in ~/.config/copier/settings.yaml and verify that trusted_prefixes does not contain overly permissive paths or domains.

References

• Official GitHub Release (v9.15.2)
• GitHub Security Advisory (GHSA-9gmc-jqmh-3rvm)
• National Vulnerability Database (NVD) Record
• CVE.org Record
• Core Commit (v9.15.1 -> v9.15.2 Release)
• Subsequent dependency update (rumdl 0.2.5)

---

Read the full report for CVE-2026-53951 on our website for more details including interactive diagrams and full exploit analysis.