AIKIDO-2026-284835

copier is vulnerable to Deserialization of Untrusted Data

GHSA-v9wr-3fjh-hg69Published Aug 5, 2026

CVE Score

High

Deserialization of Untrusted Data

TL;DR

Copier loads a template's copier.yml and its !include configuration files with a subclass of PyYAML's FullLoader, which resolves Python-specific tags such as !!python/name:. A malicious template can set _envops.finalize to a callable like os.system, which Jinja then invokes on the result of every rendered expression. This lets an untrusted template run arbitrary shell commands during a normal copy or update without the user passing --trust. The fix derives the configuration loader from SafeLoader so Python-specific tags are rejected.

How do I fix this?

Upgrade the copier library to the patch version.

Who does this affect?

You are affected if you run copier copy or copier update against an untrusted or externally supplied template (including one referenced via _src_path in a project's .copier-answers.yml) on copier 3.0.0 through 9.17.0. No --trust flag is required: the payload lives entirely in the template's copier.yml or an !included config file, so simply rendering the template runs the injected callable. You are not exposed if every template you process is one you fully control.