CVE-2026-62999

Name of the Vulnerable Software and Affected Versions Copier versions 9.5.0 through 9.16.0

Description Copier is a library and CLI app used for rendering project templates. A flaw exists where percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before the path is decoded by an HTTP server or Git transport. This allows unsafe template features from a repository located outside the trusted prefix to be executed following user interaction.

Recommendations Update to version 9.17.0.