CVE-2026-62999

{
  "id": "CVE-2026-62999",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-31T20:16:53.523",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing unsafe template features from a repository outside the trusted prefix to run after user interaction. This issue is fixed in version 9.17.0."
    },
    {
      "lang": "es",
      "value": "Copier es una biblioteca y aplicación CLI para renderizar plantillas de proyecto. Desde la versión 9.5.0 hasta la 9.16.0, los segmentos de directorio padre codificados por porcentaje o los separadores de ruta codificados en una URL de plantilla pueden coincidir con un prefijo de repositorio de confianza configurado antes de que un servidor HTTP o un transporte Git decodifique la ruta, permitiendo que características de plantilla inseguras de un repositorio fuera del prefijo de confianza se ejecuten después de la interacción del usuario. Este problema está solucionado en la versión 9.17.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "copier-org",
          "product": "copier",
          "versions": [
            {
              "version": ">= 9.5.0, <= 9.16.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-31T19:59:06.929791Z",
          "id": "CVE-2026-62999",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-180"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/copier-org/copier/commit/7408f0d6287a7bf452715fd9f25dc54eaba3c295",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/copier-org/copier/releases/tag/v9.17.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/copier-org/copier/security/advisories/GHSA-34mv-rjq9-5mch",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}