AIKIDO-2026-294677
copier is vulnerable to Sandbox Escape
87
High Risk
This Affects:
copierTL;DR
Copier renders untrusted template files through a stock Jinja SandboxedEnvironment that exposes _copier_conf in the context. Public attributes there reach dangerous capabilities: PurePath.parser leads to the os module on newer Python, and the SettingsModel exposes parse_raw, parse_file, and from_file methods that perform file I/O or unsafe pickle deserialization. A template declaring no unsafe features can therefore escape the sandbox and execute code without --trust. The fix subclasses the sandbox to reject module-valued attributes and the dangerous settings methods.
Who does this affect?
You are affected if you run copier copy or copier update against an untrusted or externally supplied template on copier 9.5.0 through 9.17.0, without --trust. The _copier_conf.settings pickle path (parse_file/parse_raw/from_file) works on any Python version; the _copier_conf.src_path.parser module-traversal path additionally requires the host to run Python 3.13+. You are not exposed if every template you render is one you fully control.
Background info
copier is vulnerable to Sandbox Escape in versions 9.5.0 - 9.17.0.
How to fix this
Upgrade the copier library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant