CVE-2026-62999: Copier Path Traversal Vulnerability

CVE-2026-62999 Overview

Copier is a widely used Python library and command-line tool for rendering project templates. CVE-2026-62999 is a path traversal vulnerability [CWE-22] affecting Copier versions 9.5.0 through 9.16.0. The flaw allows percent-encoded parent-directory segments or encoded path separators in a template URL to match a configured trusted repository prefix before the HTTP server or Git transport decodes the path. As a result, unsafe template features from a repository outside the trusted prefix can execute after user interaction. The maintainers fixed the issue in version 9.17.0.

Critical Impact
An attacker can bypass Copier's trusted-prefix allowlist and induce a user to render a malicious template that executes unsafe features such as arbitrary Jinja extensions or task hooks.

Affected Products

Copier 9.5.0 through 9.16.0
Projects and CI pipelines that consume templates via Copier with a configured trust prefix allowlist
Downstream tools embedding the Copier library for template rendering

Discovery Timeline

2026-07-31 - CVE-2026-62999 published to the National Vulnerability Database
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-62999

Vulnerability Analysis

Copier lets users mark specific repository URL prefixes as trusted so that templates originating from those prefixes may run unsafe features, including Jinja extensions and task commands. The trust check compares the raw template URL against the configured prefix list before the URL is normalized. Because the comparison is performed on the still-encoded string, an attacker can craft a URL containing percent-encoded parent-directory segments (%2E%2E%2F) or encoded slashes (%2F) that textually match a trusted prefix.

When Copier subsequently hands the URL to the HTTP client or Git transport, the transport decodes those sequences and resolves the request to a different repository under attacker control. The user believes they are rendering a trusted template, so Copier permits unsafe features to run during rendering.

Root Cause

The root cause is missing URL normalization prior to the trusted-prefix comparison in copier/_settings.py. Without decoding percent-encoded characters, the trust logic treats semantically different URLs as equal, violating the security boundary intended by the allowlist.

Attack Vector

Exploitation requires user interaction — the victim must invoke copier copy or copier update against the attacker-supplied URL. The attack is network-based and does not require authentication, but relies on a victim who has configured a trusted prefix that the attacker can textually shadow. Successful exploitation yields confidentiality, integrity, and availability impact on the victim host through arbitrary command execution in the template rendering context.

python

 from os.path import expanduser
 from pathlib import Path
 from typing import Any
-from urllib.parse import urlsplit, urlunsplit
+from urllib.parse import unquote, urlsplit, urlunsplit
 
 import yaml
 from platformdirs import user_config_path
# Source: https://github.com/copier-org/copier/commit/7408f0d6287a7bf452715fd9f25dc54eaba3c295

The patch imports unquote so that URL components are decoded before the trust comparison, closing the encoding-based bypass.

Detection Methods for CVE-2026-62999

Indicators of Compromise

Copier invocations against template URLs containing %2E%2E%2F, %2F, or other percent-encoded path separators in the repository segment.
Local Copier configuration files referencing trusted prefixes that could be textually shadowed by encoded traversal.
Unexpected child processes spawned by copier during template rendering, such as shell interpreters running task hooks.
New or modified files under a project directory immediately after a copier copy or copier update run from an unfamiliar URL.

Detection Strategies

Inspect shell history, CI logs, and audit trails for copier command lines containing percent-encoded characters in the URL argument.
Alert on Copier processes launching interpreters such as bash, sh, python, or powershell outside expected template workflows.
Compare installed Copier versions across developer workstations and build agents to identify hosts still running 9.5.0 through 9.16.0.

Monitoring Recommendations

Log outbound Git and HTTPS requests from developer and CI hosts and flag repository hosts that differ from configured trusted origins.
Monitor for modifications to ~/.config/copier and per-project .copier-answers.yml files that add or alter trusted prefixes.
Track EDR telemetry for process trees rooted at copier that include file writes to sensitive paths such as ~/.ssh, ~/.aws, or CI secret directories.

How to Mitigate CVE-2026-62999

Immediate Actions Required

Upgrade Copier to version 9.17.0 or later on all developer workstations, container images, and CI runners.
Audit existing Copier trust configurations and remove overly broad prefixes that could be shadowed by encoded traversal.
Re-review any templates rendered from external URLs since adopting Copier 9.5.0 to confirm no unauthorized tasks or extensions executed.

Patch Information

The fix is available in Copier release v9.17.0. The corrective change is documented in the upstream commit 7408f0d and described in GitHub Security Advisory GHSA-34mv-rjq9-5mch. Install with pip install --upgrade 'copier>=9.17.0'.

Workarounds

Refuse to render templates from URLs that contain percent-encoded characters in the host or path components until the upgrade is complete.
Temporarily remove trusted prefixes from Copier configuration and require the --trust flag on a per-invocation basis after manual URL review.
Pin template sources in project answer files to fully qualified, canonical URLs verified against the intended repository host.

bash

# Configuration example
pip install --upgrade 'copier>=9.17.0'
copier --version

# Verify no encoded traversal in stored template URLs
grep -R --line-number -E '%2[eEfF]' ~/.config/copier .copier-answers.yml 2>/dev/null