CyberRota Analysis
AI-GeneratedThe vulnerability affects versions 9.5.0 through 9.16.0 of the Copier library and CLI application, allowing malicious template features from untrusted repositories to execute due to improper handling of percent-encoded path segments. This could lead to unauthorized access or execution of unsafe code after user interaction. Organizations using affected versions should prioritize upgrading to version 9.17.0 to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing unsafe template features from a repository outside the trusted prefix to run after user interaction. This issue is fixed in version 9.17.0.