CVE Explorer

CVE-2026-34730

Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data feature allows a template to load YAML files using template-controlled paths. If untrusted templates are in scope, a malicious template can read attacker-chosen YAML-parseable local files that are accessible to the user running Copier and expose their contents in rendered output. This issue has been patched in version 9.14.1.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:a8b74e942cd52729fc9cbe56abfd9b29a3291f442955bf3296cea6f0024860f0

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"copier","vendor":"copier-org","versions":[{"status":"affected","version":"< 9.14.1"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:c0c10f2e6d9e36a2b1b21ff909a0a87f9c9fd940aa1c2c1a96e571cace26e5ea · sha256:c7afdb0a66cbf98f… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:c0c10f2e6d9e36a2b1b21ff909a0a87f9c9fd940aa1c2c1a96e571cace26e5ea · sha256:c7afdb0a66cbf98f… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-22","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:c0c10f2e6d9e36a2b1b21ff909a0a87f9c9fd940aa1c2c1a96e571cace26e5ea · sha256:c7afdb0a66cbf98f… · /containers/cna/problemTypes/0/descriptions/0

Source references

4 source assertions

{"name":"https://github.com/copier-org/copier/commit/5413062eb17b73dc885f5e645cdc161e69ef641b","tags":["x_refsource_MISC"],"url":"https://github.com/copier-org/copier/commit/5413062eb17b73dc885f5e645cdc161e69ef641b"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:c0c10f2e6d9e36a2b1b21ff909a0a87f9c9fd940aa1c2c1a96e571cace26e5ea · sha256:c7afdb0a66cbf98f… · /containers/cna/references/1

{"name":"https://github.com/copier-org/copier/releases/tag/v9.14.1","tags":["x_refsource_MISC"],"url":"https://github.com/copier-org/copier/releases/tag/v9.14.1"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:c0c10f2e6d9e36a2b1b21ff909a0a87f9c9fd940aa1c2c1a96e571cace26e5ea · sha256:c7afdb0a66cbf98f… · /containers/cna/references/2

{"tags":["exploit"],"url":"https://github.com/copier-org/copier/security/advisories/GHSA-hgjq-p8cr-gg4h"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:c0c10f2e6d9e36a2b1b21ff909a0a87f9c9fd940aa1c2c1a96e571cace26e5ea · sha256:c7afdb0a66cbf98f… · /containers/adp/0/references/0

{"name":"https://github.com/copier-org/copier/security/advisories/GHSA-hgjq-p8cr-gg4h","tags":["x_refsource_CONFIRM"],"url":"https://github.com/copier-org/copier/security/advisories/GHSA-hgjq-p8cr-gg4h"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:c0c10f2e6d9e36a2b1b21ff909a0a87f9c9fd940aa1c2c1a96e571cace26e5ea · sha256:c7afdb0a66cbf98f… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer