CVE-2026-23986: 
Python vulnerability analysis and mitigation

CVE-2026-23986 is a symlink-following path traversal vulnerability in Copier, a Python-based project templating tool, that allows a malicious template author to write arbitrary files outside the intended destination directory. It affects all Copier versions prior to 9.11.2 (pip package copier). The vulnerability was published on January 21, 2026, and patched in version 9.11.2 released the same day. It carries a CVSS v3.1 score of 7.1 (High) and a CVSS v4.0 score of 6.9 (Medium) (GitHub Advisory, Copier Security Advisory).

The root cause is improper handling of UNIX symbolic links during template rendering (CWE-61: UNIX Symbolic Link Following). When a Copier template sets _preserve_symlinks: true in copier.yml, the template engine walks the file tree using os.scandir without verifying that symlink targets remain within the template root. A malicious template can include a directory symlink pointing outside the template root (e.g., ln -s ../other other) alongside a Jinja-rendered file whose output path resolves through that symlink (e.g., {{ pathjoin('other', 'sensitive.txt') }}.jinja). When the user runs copier copy, the rendered file is written to the symlink's target location outside the destination directory, effectively overwriting arbitrary files within the user's write permissions. Notably, the exploit is non-deterministic because os.scandir yields directory entries in arbitrary order — the symlink directory entry must be processed before the file entry for the overwrite to succeed (GitHub Advisory, Patch Commit).

Successful exploitation allows a malicious template author to overwrite arbitrary files on the victim's filesystem, limited only by the user's write permissions. This can result in data destruction, system misconfiguration, corruption of application files, or injection of malicious content into existing files. There is no confidentiality impact (files cannot be read via this vector), but integrity and availability are both rated High. The attack operates entirely within the context of the user running Copier, so no privilege escalation beyond the user's existing permissions is possible (GitHub Advisory, Copier Security Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, demonstrating the attack with a reproducible shell script. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.018% (0.000180), indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — the victim must choose to generate a project from the malicious template — and the exploit is non-deterministic due to os.scandir ordering (Copier Security Advisory, GitHub Advisory).

1. Craft a malicious template: Create a template directory (src/) containing a copier.yml with _preserve_symlinks: true, a directory symlink pointing outside the template root (e.g., ln -s ../other other), and a Jinja template file whose rendered output path traverses through the symlink (e.g., {{ pathjoin('other', 'sensitive.txt') }}.jinja containing the desired malicious content).
2. Host or distribute the template: Publish the malicious template to a public or private repository (e.g., GitHub) where target users are likely to discover and use it.
3. Wait for victim interaction: The victim runs copier copy <malicious-template-url> dst/ or uvx copier copy --overwrite src/ dst/, triggering Copier to walk the template file tree.
4. Exploit symlink traversal: If os.scandir yields the symlink directory entry before the Jinja template file entry (non-deterministic), Copier resolves the symlink and renders the Jinja file, writing its content to the symlink's target path outside the destination directory (e.g., overwriting other/sensitive.txt in the parent directory).
5. Achieve arbitrary file overwrite: The attacker's chosen content is written to any file the victim user has write access to, enabling configuration tampering, script injection, or data destruction (Copier Security Advisory, GitHub Advisory).

• File System: Unexpected modification timestamps on files outside the Copier destination directory shortly after running copier copy; presence of a copier.yml containing _preserve_symlinks: true in a template from an untrusted source; directory symlinks in a template's source tree pointing to paths outside the template root.
• Logs: Shell history or audit logs showing execution of copier copy or uvx copier copy --overwrite against an external or unfamiliar template source.
• Process: Python/uvx processes spawned that write files to unexpected filesystem locations outside the designated project destination directory.

Upgrade Copier to version 9.11.2 or later, which disallows symlink-based includes that resolve outside the template root by raising a ForbiddenPathError (Copier Release v9.11.2, Patch Commit). No official workaround is provided for users who cannot upgrade immediately. As a precautionary measure, avoid using Copier templates from untrusted or unverified sources, and audit any existing templates for the _preserve_symlinks: true setting combined with directory symlinks pointing outside the template root (GitHub Advisory).

The vulnerability was credited to researcher cbrown1234 and remediated by sisp (the Copier maintainer), with the fix reviewed and released promptly on January 20–21, 2026. The advisory received minor community attention on Bluesky and security aggregator sites shortly after disclosure, but no significant media coverage or notable researcher commentary beyond the GitHub advisory has been identified (Copier Security Advisory).