AIKIDO-2026-294677

copier is vulnerable to Sandbox Escape

GHSA-7537-j7hq-f8p9Published Aug 5, 2026

CVE Score

High

Sandbox Escape

TL;DR

Copier renders untrusted template files through a stock Jinja SandboxedEnvironment that exposes _copier_conf in the context. Public attributes there reach dangerous capabilities: PurePath.parser leads to the os module on newer Python, and the SettingsModel exposes parse_raw, parse_file, and from_file methods that perform file I/O or unsafe pickle deserialization. A template declaring no unsafe features can therefore escape the sandbox and execute code without --trust. The fix subclasses the sandbox to reject module-valued attributes and the dangerous settings methods.

How do I fix this?

Upgrade the copier library to the patch version.

Who does this affect?

You are affected if you run copier copy or copier update against an untrusted or externally supplied template on copier 9.5.0 through 9.17.0, without --trust. The _copier_conf.settings pickle path (parse_file/parse_raw/from_file) works on any Python version; the _copier_conf.src_path.parser module-traversal path additionally requires the host to run Python 3.13+. You are not exposed if every template you render is one you fully control.