CVE-2026-34730

low-risk
Published 2026-04-02

Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data feature allows a template to load YAML files using template-controlled paths. If untrusted templates are in scope, a malicious template can read attacker-chosen YAML-parseable local files that are accessible to the user running Copier and expose their contents in rendered output. This issue has been patched in version 9.14.1.

Do I need to act?

-
0.01% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Copier

Affected Vendors

Copier-Org

References (4)

Patch https://github.com/copier-org/copier/commit/5413062eb17b73dc885f5e645cdc161e69ef...
Release Notes https://github.com/copier-org/copier/releases/tag/v9.14.1
Exploit https://github.com/copier-org/copier/security/advisories/GHSA-hgjq-p8cr-gg4h
Exploit https://github.com/copier-org/copier/security/advisories/GHSA-hgjq-p8cr-gg4h
23
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal