{"action":"Upgrade copier to 9.15.2 or later.","affected":[{"fixed":"9.15.2","introduced":"9.5.0"}],"component":"copier","cve_ids":["CVE-2026-53951"],"ecosystem":"PyPI","epss":0.00262,"exploited":false,"fixed_versions":["9.15.2"],"ghsa_id":"GHSA-9gmc-jqmh-3rvm","id":"tcs_01M5KH7YTHVEBCZGRQ6NFB4TQA","modified_at":"2026-09-10T12:15:03.046958877Z","published_at":"2026-09-10T09:44:51.713122Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3818","https://github.com/copier-org/copier/security/advisories/GHSA-9gmc-jqmh-3rvm","https://nvd.nist.gov/vuln/detail/CVE-2026-53951","https://github.com/copier-org/copier","https://github.com/copier-org/copier/releases/tag/v9.15.2","https://pypi.org/project/copier","https://github.com/advisories/GHSA-9gmc-jqmh-3rvm"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2026-3818","url":"https://osv.dev/vulnerability/PYSEC-2026-3818"}],"summary":"Copier has a trust-prefix bypass via path traversal that runs tasks unprompted"}