{"action":"Upgrade copier to 9.15.2 or later.","affected":[{"fixed":"9.15.2","introduced":"9.5.0"}],"component":"copier","cve_ids":["CVE-2026-53951"],"ecosystem":"PyPI","epss":0.00261,"exploited":false,"fixed_versions":["9.15.2"],"ghsa_id":"GHSA-9gmc-jqmh-3rvm","id":"tcs_01M5KFAV81P85W84NW7EFCRZ67","modified_at":"2026-09-10T12:25:32.628390125Z","published_at":"2026-08-19T19:16:54Z","references":["https://osv.dev/vulnerability/GHSA-9gmc-jqmh-3rvm","https://github.com/copier-org/copier/security/advisories/GHSA-9gmc-jqmh-3rvm","https://nvd.nist.gov/vuln/detail/CVE-2026-53951","https://github.com/copier-org/copier","https://github.com/copier-org/copier/releases/tag/v9.15.2"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-9gmc-jqmh-3rvm","url":"https://osv.dev/vulnerability/GHSA-9gmc-jqmh-3rvm"},{"source":"nvd","source_id":"CVE-2026-53951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53951"}],"summary":"Copier has a trust-prefix bypass via path traversal that runs tasks unprompted"}