CVE-2026-62999: falha de alta gravidade em copier-org copier
Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.4%
Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing unsafe template features from a repository outside the trusted prefix to run after user interaction. This issue is fixed in version 9.17.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
copier-org · copierCVEs relacionadas — copier-org copier
No mesmo produto, das mais perigosas para as menos.
CVE-2026-34726MEDIUMCopier `_subdirectory` allows template root escape via parent-directory traversalEPSS 0.4%CVE-2026-34730MEDIUMCopier `_external_data` allows path traversal and absolute-path local file read without unsafe modeEPSS 0.3%CVE-2026-23986MEDIUMCopier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: trueEPSS 0.3%CVE-2025-55214MEDIUMCopier safe template has filesystem write access outside destination pathEPSS 0.3%CVE-2026-53951HIGHCopier: trust-prefix bypass via path traversal runs tasks unpromptedEPSS 0.3%CVE-2025-55201HIGHCopier safe template has arbitrary filesystem read/write accessEPSS 0.3%