The vulnerability occurs when Copier verifies trust prefixes for template URLs using a raw string start‑with comparison without normalizing the path. A malicious template reference that begins with a trusted prefix but contains path traversal components gains trust, resolving to an attacker‑controlled template that runs its tasks, migrations, or Jinja extensions without prompting. This flaw allows arbitrary code execution in the context of the user running Copier, matching CWE‑22 Path Traversal and CWE‑94 Code Injection.

The issue affects the Copier library and CLI tool, specifically the copier-org:copier product. Versions from 9.5.0 through 9.15.1 are vulnerable. Any environment that invokes these versions—local development machines, CI/CD pipelines, or automation scripts—introduces risk.

The CVSS score of 8.8 indicates high severity. The EPSS score is below 1%, indicating low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a crafted template URL or local path supplied to Copier that matches a trusted prefix through string traversal, leading to arbitrary command execution. The high severity combined with the possibility of remote or local execution means affected users should address the flaw promptly.