PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53951 copier-org CVE debrief

CVE-2026-53951 is a high-severity vulnerability in Copier library and CLI app versions 9.5.0 through 9.15.1. The vulnerability arises from the `trust` setting's prefix match in `copier/_settings.py`, which compares template URLs against trusted prefixes using a raw `str.startswith` without path normalization. This allows a template reference to be granted trust if it textually starts with a trusted prefix, even if it contains `..` and resolves to a different, attacker-controlled template. The attacker-controlled template's `tasks`, `migrations`, or `jinja_extensions` can then run without the `--trust` prompt, leading to arbitrary command execution. The issue was patched in version 9.15.2.

Vendor
copier-org
Product
copier
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-08
Original CVE updated
2026-07-10
Advisory published
2026-07-08
Advisory updated
2026-07-10

Who should care

Users of Copier library and CLI app versions 9.5.0 through 9.15.1 should be aware of this high-severity vulnerability and take immediate action to upgrade to version 9.15.2 or later. This vulnerability could allow attackers to execute arbitrary commands, potentially leading to system compromise.

Technical summary

The vulnerability in Copier library and CLI app versions 9.5.0 through 9.15.1 is caused by the insecure prefix matching in the `trust` setting. The `str.startswith` method is used without path normalization, allowing an attacker to bypass trust checks by using `..` in the template URL. This can lead to the execution of arbitrary commands when the template is fetched and processed. The issue arises because the template URL is normalized during fetching, but the trust check does not account for this normalization. As a result, an attacker can manipulate the template URL to point to a malicious template, leading to potential system compromise.

Defensive priority

High

Recommended defensive actions

  • Upgrade Copier library and CLI app to version 9.15.2 or later
  • Review and update trust settings for template URLs
  • Monitor for suspicious template usage and command execution
  • Implement additional security controls, such as input validation and sanitization
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-08T16:16:30.623Z and last modified on 2026-07-10T19:06:45.623Z. The NVD entry is currently Deferred. Evidence is limited, and defenders should verify the affected scope and vendor guidance. The vulnerability affects Copier library and CLI app versions 9.5.0 through 9.15.1, and the issue was patched in version 9.15.2.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-53951 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-53951

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-53951 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-53951

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.