Symlink Vulnerability in Copier Library and CLI Application by Copier

CVE-2026-23968

What is CVE-2026-23968?

The Copier library and command-line interface (CLI) application have a vulnerability that permits the inclusion of arbitrary files and directories from outside the local template location. This flaw arises from the manipulation of symlinks in project templates alongside the default setting of _preserve_symlinks: false. Users may be misled into believing that they are using a safe template, unaware that unsafe features can still expose their environment to risks. The issue has been addressed in version 9.11.2, which includes a patch to ensure that generated projects do not unintentionally include unsafe references.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References