CVE-2026-53951

Name of the Vulnerable Software and Affected Versions Copier versions 9.5.0 through 9.15.1

Description An issue exists in the trust setting's prefix match within copier/ settings.py where the template URL is compared against a trusted prefix using str.startswith without path normalization. Because the URL is normalized during the actual fetch process (using Path.resolve() for local paths and libcurl dot-segment removal for HTTPS), a template reference containing .. that textually starts with a trusted prefix can be granted trust. This allows an attacker-controlled template to execute tasks, migrations, or jinja extensions without the --trust prompt, leading to arbitrary command execution.

Recommendations Update to version 9.15.2.