Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data feature allows a template to load YAML files using template-controlled paths. If untrusted templates are in scope, a malicious template can read attacker-chosen YAML-parseable local files that are accessible to the user running Copier and expose their contents in rendered output. This issue has been patched in version 9.14.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-34730 Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data feature allows a template to load YAML files using t… https://www.cve.org/CVERecord?id=CVE-2026-34730
Post summary
The tweet announces CVE‑2026‑34730, describes the vulnerability’s technical details, and indicates that version 9.14.1 includes a patch.
🚨*CVE* CVE-2026-34730 Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's _external_data feature allows a template to load YAML files using t… https://www.cve.org/CVERecord?id=CVE-2026-34730 ----- Traducción: CVE-2026-34730 Cop… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑34730, noting a flaw in Copier’s _external_data feature that allows loading of YAML files before version 9.14.1.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | copier-org | copier | - | python | - |