AIKIDO-2026-234292

TL;DR

Copier's trust setting matches a template URL against a trusted prefix in copier/_settings.py after normalizing it with posixpath.normpath, but it does not percent-decode the URL first. A template reference using percent-encoded dot segments (%2e%2e), encoded separators (%2f), or backslashes (%5c or literal \) can therefore textually match a trusted prefix while the HTTP/Git layer resolves it to a different, attacker-controlled location. Because trust is granted, the untrusted template's tasks, migrations, and jinja_extensions run without the trust prompt, allowing arbitrary command execution. The fix percent-decodes the URL and folds backslashes to / before normalization and the trust comparison.