algokit (>=0.2.0, <=1.6.0), algorun (>=0.0.1b1, <=0.0.1b4) +12 more potentially affected by CVE-2025-55201 via copier (7.2.0)

copier PYPI version 7.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - algokit =0.2.0, =0.0.1b1, =2.2.4, =0.0.1a3, =0.3.0, =0.6.0, =0.9.0, =0.1.16, =1.14.0 Source cves: CVE-2025-55201 Source advisory:...

pytoil (>=0.34.0, <=0.35.0) potentially affected by CVE-2025-55201 via copier (6.1.0)

copier PYPI version 6.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - pytoil =0.34.0, =0.35.0 Source cves: CVE-2025-55201 Source advisory: OSV:GHSA-3XW7-V6CJ-5Q8H...

algokit (>=2.7.0, <=2.8.0), cicd-tools (1.0.0) +11 more potentially affected by CVE-2025-55201 via copier (>=9.0.1, <=9.9.0)

copier PYPI version =9.0.1, =2.7.0, =1.6.0b0, =0.40.0, =0.1.58, =1.0.0, =4.3.4, =4.3.4, =4.3.4, =4.3.4, =2.9.1, =2.11.0 Source cves: CVE-2025-55201 Source advisory: OSV:GHSA-3XW7-V6CJ-5Q8H...

algokit (>=2.7.0, <=2.8.0), cicd-tools (1.0.0) +11 more potentially affected by CVE-2025-55201 via copier (>=9.0.1, <=9.9.0)

copier PYPI version =9.0.1, =2.7.0, =1.6.0b0, =0.40.0, =0.1.58, =1.0.0, =4.3.4, =4.3.4, =4.3.4, =4.3.4, =2.9.1, =2.11.0 Source cves: CVE-2025-55201 Source advisory: GHSA-3XW7-V6CJ-5Q8H...

biopipen (>=0.12.0, <=0.17.7), flet (0.9.0) +9 more potentially affected by CVE-2025-55201 via copier (8.1.0)

copier PYPI version 8.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - biopipen =0.12.0, =0.5.0, =1.3.3, =0.5.4, =0.6.1, =0.12.6, =0.5.0, =0.1.0, =0.5.1 Source cves: CVE-2025-55201 Source advisory: OSV:GHSA-3XW7-V6CJ-5Q...

atomkraft (>=0.0.1, <=0.1.1), dialogy (>=0.9.21, <=2.2.1) +2 more potentially affected by CVE-2025-55201 via copier (6.2.0)

copier PYPI version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - atomkraft =0.0.1, =0.9.21, =0.18.0, =0.1.0, =0.3.9 Source cves: CVE-2025-55201 Source advisory: OSV:GHSA-3XW7-V6CJ-5Q8H...

algokit (>=0.2.0, <=2.8.0), algorun (>=0.0.1b1, <=0.0.1b4) +34 more potentially affected by CVE-2025-55214 via copier (>=7.1.0, <=9.9.0)

copier PYPI version =7.1.0, =0.2.0, =0.0.1b1, =0.11.0, =2.2.2, =2.0.0, =0.9.0, =0.10.0, =0.1.1, =0.1.10, =0.0.1a3, =0.5.0, =1.6.0b0, =1.3.3, =1.3.5 and more Source cves: CVE-2025-55214 Source advisory: SNYK:PYTHON-COPIER-12009006...

Directory Traversal

Overview copier is an A library for rendering project templates. Affected versions of this package are vulnerable to Directory Traversal via the rendering process when generating a directory structure whose rendered path is either a relative parent path or an absolute path. An attacker can...

CVE-2025-55214

Copier library and CLI app for rendering project templates. From 7.1.0 to before 9.9.1, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it...

CVE-2025-55201

Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files because Copier exposes a few pathlib.Path objects in the Jinja context which have unconstrained I/O methods. This effectively renders the security model w.r.t...

algokit (>=2.7.0, <=2.8.0), cicd-tools (1.0.0) +11 more potentially affected by CVE-2025-55201 via copier (>=9.0.1, <=9.9.0)

copier PYPI version =9.0.1, =2.7.0, =1.6.0b0, =0.40.0, =0.1.58, =1.0.0, =4.3.4, =4.3.4, =4.3.4, =4.3.4, =2.9.1, =2.11.0 Source cves: CVE-2025-55201 Source advisory: SNYK:PYTHON-COPIER-12009009...

CVE-2025-55214 Copier safe template has filesystem write access outside destination path

Copier library and CLI app for rendering project templates. From 7.1.0 to before 9.9.1, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it...

algokit (>=0.2.0, <=2.8.0), algorun (>=0.0.1b1, <=0.0.1b4) +34 more potentially affected by CVE-2025-55214 via copier (>=7.1.0, <=9.9.0)

copier PYPI version =7.1.0, =0.2.0, =0.0.1b1, =0.11.0, =2.2.2, =2.0.0, =0.9.0, =0.10.0, =0.1.1, =0.1.10, =0.0.1a3, =0.5.0, =1.6.0b0, =1.3.3, =1.3.5 and more Source cves: CVE-2025-55214 Source advisory: MEND:CVE-2025-55214...

CVE-2025-55214

Copier library and CLI app for rendering project templates. From 7.1.0 to before 9.9.1, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it...

CVE-2025-55214 Copier safe template has filesystem write access outside destination path

Copier library and CLI app for rendering project templates. From 7.1.0 to before 9.9.1, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it...

CVE-2025-55214

CVE-2025-55214 (Copier) : A directory traversal vulnerability affects Copier libraries and CLI from version 7.1.0 up to, but not including, 9.9.1. When using a safe template, an attacker could cause files to be written outside the destination path by exploiting the template rendering of a generat...

CVE-2025-55214 Copier safe template has filesystem write access outside destination path

Copier library and CLI app for rendering project templates. From 7.1.0 to before 9.9.1, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it...

CVE-2025-55201

Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files because Copier exposes a few pathlib.Path objects in the Jinja context which have unconstrained I/O methods. This effectively renders the security model w.r.t...

algokit (>=0.2.0, <=2.8.0), algorun (>=0.0.1b1, <=0.0.1b4) +42 more potentially affected by CVE-2025-55201 via copier (>=2.3.3, <=9.9.0)

copier PYPI version =2.3.3, =0.2.0, =0.0.1b1, =0.0.1, =0.11.0, =0.31.0, =1.4.14, =0.2.3, =2.0.0, =0.18.0, =0.9.0, =0.10.0, =0.1.1, =0.14.1, =0.1.0, =0.19.0 and more Source cves: CVE-2025-55201 Source advisory: MEND:CVE-2025-55201...

CVE-2025-55201

CVE-2025-55201 concerns the Copier library/CLI used for rendering project templates. Prior to version 9.9.1, the template rendering context exposes certain pathlib.Path objects in Jinja with unconstrained I/O methods, enabling a safe template to read and write arbitrary files on the filesystem an...