AIKIDO-2026-284835
copier is vulnerable to Deserialization of Untrusted Data
87
High Risk
This Affects:
copierTL;DR
Copier loads a template's copier.yml and its !include configuration files with a subclass of PyYAML's FullLoader, which resolves Python-specific tags such as !!python/name:. A malicious template can set _envops.finalize to a callable like os.system, which Jinja then invokes on the result of every rendered expression. This lets an untrusted template run arbitrary shell commands during a normal copy or update without the user passing --trust. The fix derives the configuration loader from SafeLoader so Python-specific tags are rejected.
Who does this affect?
You are affected if you run copier copy or copier update against an untrusted or externally supplied template (including one referenced via _src_path in a project's .copier-answers.yml) on copier 3.0.0 through 9.17.0. No --trust flag is required: the payload lives entirely in the template's copier.yml or an !included config file, so simply rendering the template runs the injected callable. You are not exposed if every template you process is one you fully control.
Background info
copier is vulnerable to Deserialization of Untrusted Data in versions 3.0.0 - 9.17.0.
How to fix this
Upgrade the copier library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant