PyPI/copier CVE-2026-53951: high 8.8, EPSS 0.26%

Copier has a trust-prefix bypass via path traversal that runs tasks unprompted

Action: Upgrade copier to 9.15.2 or later.

pip install copier==9.15.2

Affected

Fixed versions

Sources

• osv: GHSA-9gmc-jqmh-3rvm
• nvd: CVE-2026-53951
• https://github.com/copier-org/copier/security/advisories/GHSA-9gmc-jqmh-3rvm
• https://github.com/copier-org/copier
• https://github.com/copier-org/copier/releases/tag/v9.15.2

CVE-2026-53951 · published 2026-08-19T19:16:54Z · modified 2026-09-10T12:25:32.628390125Z · JSON