EUVD-2024-37525

Malicious code in bioql PyPI...

EUVD-2025-8432

Malicious code in bioql PyPI...

EUVD-2025-25132

Malicious code in bioql PyPI...

EUVD-2025-25131

Malicious code in bioql PyPI...

BIT-JUPYTERLAB-2024-39700 Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action

JupyterLab extension template is a copier template for JupyterLab extensions. Repositories created using this template with test option include update-integration-tests.yml workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the template to...

ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers

...

CVE-2025-55214

Copier library and CLI app for rendering project templates. From 7.1.0 to before 9.9.1, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it...

CVE-2025-55201

Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files because Copier exposes a few pathlib.Path objects in the Jinja context which have unconstrained I/O methods. This effectively renders the security model w.r.t...

algokit (>=0.2.0, <=2.8.0), algorun (>=0.0.1b1, <=0.0.1b4) +34 more potentially affected by CVE-2025-55214 via copier (>=7.1.0, <=9.9.0)

copier PYPI version =7.1.0, =0.2.0, =0.0.1b1, =0.11.0, =2.2.2, =2.0.0, =0.9.0, =0.10.0, =0.1.1, =0.1.10, =0.0.1a3, =0.5.0, =1.6.0b0, =1.3.3, =1.3.5 and more Source cves: CVE-2025-55214 Source advisory: GHSA-P7Q8-GRRJ-3M8W...

algokit (>=0.2.0, <=2.8.0), algorun (>=0.0.1b1, <=0.0.1b4) +34 more potentially affected by CVE-2025-55214 via copier (>=7.1.0, <=9.9.0)

copier PYPI version =7.1.0, =0.2.0, =0.0.1b1, =0.11.0, =2.2.2, =2.0.0, =0.9.0, =0.10.0, =0.1.1, =0.1.10, =0.0.1a3, =0.5.0, =1.6.0b0, =1.3.3, =1.3.5 and more Source cves: CVE-2025-55214 Source advisory: OSV:GHSA-P7Q8-GRRJ-3M8W...

GHSA-P7Q8-GRRJ-3M8W Copier's safe template has filesystem write access outside destination path

Impact Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it turns out, a safe template can currently write files outside the destination path...

Copier's safe template has filesystem write access outside destination path

Impact Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it turns out, a safe template can currently write files outside the destination path...

entangled-cli (>=2.0.0, <=2.0.2), flet (>=0.10.0, <=0.11.0) +9 more potentially affected by CVE-2025-55201 via copier (8.3.0)

copier PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - entangled-cli =2.0.0, =0.10.0, =0.10.0, =0.1.1, =0.1.10, =0.7.1, =0.12.5, =4.1.0b1, =4.3.0b3, =4.1.0b1, =4.1.0b1, =4.3.4rc3 Source cves:...

dialogy (>=2.2.2, <=2.2.3) potentially affected by CVE-2025-55201 via copier (7.1.0)

copier PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - dialogy =2.2.2, =2.2.3 Source cves: CVE-2025-55201 Source advisory: OSV:GHSA-3XW7-V6CJ-5Q8H...

data-pipelines-cli (>=0.31.0, <=0.32.0), pytoil (>=0.36.0, <=0.38.1) potentially affected by CVE-2025-55201 via copier (7.0.1)

copier PYPI version 7.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - data-pipelines-cli =0.31.0, =0.36.0, =0.38.1 Source cves: CVE-2025-55201 Source advisory: OSV:GHSA-3XW7-V6CJ-5Q8H...

dbt-coves (>=1.4.15, <=1.9.0), pytoil (>=0.32.1, <=0.33.0) potentially affected by CVE-2025-55201 via copier (6.0.0)

copier PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - dbt-coves =1.4.15, =0.32.1, =0.33.0 Source cves: CVE-2025-55201 Source advisory: OSV:GHSA-3XW7-V6CJ-5Q8H...

flexlate (>=0.14.1, <=0.14.2) potentially affected by CVE-2025-55201 via copier (6.0.0b0)

copier PYPI version 6.0.0b0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - flexlate =0.14.1, =0.14.2 Source cves: CVE-2025-55201 Source advisory: OSV:GHSA-3XW7-V6CJ-5Q8H...

dialogy (>=0.2.3, <=0.9.20), flexlate-dev (>=0.1.0, <=0.19.0) +2 more potentially affected by CVE-2025-55201 via copier (5.1.0)

copier PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - dialogy =0.2.3, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2025-55201 Source advisory: OSV:GHSA-3XW7-V6CJ-5Q8H...

horn-py (>=0.3.2, <=0.6.3) potentially affected by CVE-2025-55201 via copier (2.3.3)

copier PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - horn-py =0.3.2, =0.6.3 Source cves: CVE-2025-55201 Source advisory: OSV:GHSA-3XW7-V6CJ-5Q8H...

algokit (>=0.2.0, <=1.6.0), algorun (>=0.0.1b1, <=0.0.1b4) +12 more potentially affected by CVE-2025-55201 via copier (7.2.0)

copier PYPI version 7.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - algokit =0.2.0, =0.0.1b1, =2.2.4, =0.0.1a3, =0.3.0, =0.6.0, =0.9.0, =0.1.16, =1.14.0 Source cves: CVE-2025-55201 Source advisory:...