PyPI/copier CVE-2026-34730: medium 5.5, EPSS 0.30%

Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode

Action: Upgrade copier to 9.14.1 or later.

pip install copier==9.14.1

Affected

Fixed versions

Sources

• osv: GHSA-hgjq-p8cr-gg4h
• https://github.com/copier-org/copier/security/advisories/GHSA-hgjq-p8cr-gg4h
• https://nvd.nist.gov/vuln/detail/CVE-2026-34730
• https://github.com/copier-org/copier/commit/5413062eb17b73dc885f5e645cdc161e69ef641b
• https://github.com/copier-org/copier
• https://github.com/copier-org/copier/releases/tag/v9.14.1

CVE-2026-34730 · published 2026-04-01T22:38:39Z · modified 2026-07-13T07:26:23.004695012Z · JSON