Copier's safe template has arbitrary filesystem read/write access

ImpactCopier's current security model shall restrict filesystem access through Jinja:- Files can only be read using % include ... %, which is limited by Jinja to reading files from the subtree of the local template clone in our case.- Files are written in the destination directory according to...

Path Traversal

Copier is vulnerable to Path Traversal. The vulnerability is due to exposing unconstrained pathlib.Path objects in the Jinja context, which allows an attacker to read and write arbitrary files on the filesystem...

Arbitrary File Read/Write

Overview copier is an A library for rendering project templates. Affected versions of this package are vulnerable to Arbitrary File Read/Write via the exposure of pathlib.Path objects in the Jinja context, which have unconstrained I/O methods. An attacker can access or modify arbitrary files on t...