15 matches found
algokit (>=0.2.0, <=1.6.0), algorun (>=0.0.1b1, <=0.0.1b4) +12 more potentially affected by CVE-2026-34726 via copier (7.2.0)
copier PYPI version 7.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - algokit =0.2.0, =0.0.1b1, =2.2.4, =0.0.1a3, =0.3.0, =0.6.0, =0.9.0, =0.1.16, =1.14.0 Source cves: CVE-2026-34726 Source advisory: OSV:PYSEC-2026-213...
entangled-cli (>=2.0.0, <=2.0.2), flet (>=0.10.0, <=0.11.0) +9 more potentially affected by CVE-2026-34726 via copier (8.3.0)
copier PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - entangled-cli =2.0.0, =0.10.0, =0.10.0, =0.1.1, =0.1.10, =0.7.1, =0.12.5, =4.1.0b1, =4.3.0b3, =4.1.0b1, =4.1.0b1, =4.3.4rc3 Source cves:...
flexlate (>=0.14.1, <=0.14.2) potentially affected by CVE-2026-34726 via copier (6.0.0b0)
copier PYPI version 6.0.0b0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - flexlate =0.14.1, =0.14.2 Source cves: CVE-2026-34726 Source advisory: OSV:PYSEC-2026-2134...
biopipen (>=0.12.0, <=0.17.7), flet (0.9.0) +9 more potentially affected by CVE-2026-34726 via copier (8.1.0)
copier PYPI version 8.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - biopipen =0.12.0, =0.5.0, =1.3.3, =0.5.4, =0.6.1, =0.12.6, =0.5.0, =0.1.0, =0.5.1 Source cves: CVE-2026-34726 Source advisory: OSV:PYSEC-2026-2134...
dialogy (>=0.2.3, <=0.9.20), flexlate-dev (>=0.1.0, <=0.19.0) +2 more potentially affected by CVE-2026-34726 via copier (5.1.0)
copier PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - dialogy =0.2.3, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2026-34726 Source advisory: OSV:PYSEC-2026-2134...
dbt-coves (>=1.4.15, <=1.9.0), pytoil (>=0.32.1, <=0.33.0) potentially affected by CVE-2026-34726 via copier (6.0.0)
copier PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - dbt-coves =1.4.15, =0.32.1, =0.33.0 Source cves: CVE-2026-34726 Source advisory: OSV:PYSEC-2026-2134...
CVE-2026-34726
CVE-2026-34726 affects Copier (library/CLI) prior to version 9.14.1. The issue stems from the _subdirectory setting, which is documented as the template root but can accept directory traversal like .., and is used directly to compute the template root. This allows a template to escape its own dir...
CVE-2026-34726
Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when...
CVE-2026-34726 Copier `_subdirectory` allows template root escape via parent-directory traversal
Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when...
algokit (>=0.2.0, <=1.6.0), algorun (>=0.0.1b1, <=0.0.1b4) +12 more potentially affected by CVE-2026-34726 via copier (7.2.0)
copier PYPI version 7.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - algokit =0.2.0, =0.0.1b1, =2.2.4, =0.0.1a3, =0.3.0, =0.6.0, =0.9.0, =0.1.16, =1.14.0 Source cves: CVE-2026-34726 Source advisory:...
algokit (>=2.7.0, <=2.10.0), cicd-tools (1.0.0) +12 more potentially affected by CVE-2026-34726 via copier (>=9.0.1, <=9.11.3)
copier PYPI version =9.0.1, =2.7.0, =1.6.0b0, =0.40.0, =0.1.58, =1.0.0, =4.3.4, =4.3.4, =5.0.0b2, =4.3.4, =4.3.4, =2.9.1, =2.51.0 Source cves: CVE-2026-34726 Source advisory: GHSA-85V3-4M8G-HRH6...
flexlate (>=0.14.1, <=0.14.2) potentially affected by CVE-2026-34726 via copier (6.0.0b0)
copier PYPI version 6.0.0b0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - flexlate =0.14.1, =0.14.2 Source cves: CVE-2026-34726 Source advisory: OSV:GHSA-85V3-4M8G-HRH6...
horn-py (>=0.3.2, <=0.6.3) potentially affected by CVE-2026-34726 via copier (2.3.3)
copier PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - horn-py =0.3.2, =0.6.3 Source cves: CVE-2026-34726 Source advisory: OSV:GHSA-85V3-4M8G-HRH6...
entangled-cli (>=2.0.0, <=2.0.2), flet (>=0.10.0, <=0.11.0) +9 more potentially affected by CVE-2026-34726 via copier (8.3.0)
copier PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - entangled-cli =2.0.0, =0.10.0, =0.10.0, =0.1.1, =0.1.10, =0.7.1, =0.12.5, =4.1.0b1, =4.3.0b3, =4.1.0b1, =4.1.0b1, =4.3.4rc3 Source cves:...
