CVE-2026-34730: 
Python vulnerability analysis and mitigation

CVE-2026-34730 is a path traversal vulnerability in Copier's _external_data feature that allows a malicious template to read arbitrary local files outside the intended subproject destination directory. It affects all versions of the copier Python package up to and including 9.14.0, and was patched in version 9.14.1 released on March 31, 2026. The vulnerability was reported by researcher sisp and published to the GitHub Advisory Database on April 1, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is CWE-22 (Path Traversal): Copier's _external_data feature allows templates to specify YAML file paths that are rendered and then passed directly to load_answersfile_data(dst_path, rendered_path), which opens Path(dst_path, answers_file) without any containment check to verify the resolved path remains within the subproject destination. This allows both parent-directory traversal (e.g., ../secret.yml) and absolute paths (e.g., /tmp/secret.yml) to be specified in the template's copier.yml, with the parsed YAML contents subsequently exposed in rendered output. Notably, this bypass works without the --UNSAFE flag, which is inconsistent with Copier's existing ForbiddenPathError protections applied to other destination-escape paths. Full PoC shell command sequences are publicly available in the security advisory (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker-controlled template to read any local file accessible to the user running Copier — including credentials, API tokens, SSH keys, or other secrets stored in YAML, JSON, or plain-text-parseable formats — and expose their contents in the rendered project output. The impact is limited to confidentiality (no integrity or availability impact), but the disclosed data could enable further attacks such as credential theft or lateral movement. The attack requires user interaction (a victim must run copier copy against a malicious template), but no privileges are required and the --UNSAFE flag is not needed (GitHub Advisory).

A proof-of-concept exploit consisting of complete, step-by-step shell command sequences is publicly available in the GitHub security advisory. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.011% (0th percentile), indicating low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Craft a malicious template: Create a template directory (src/) containing a copier.yml that defines _external_data with a path traversal payload, e.g.:

_external_data:
  secret: ../secret.yml

2. Add a data-leaking template file: Create a Jinja template file in src/ that renders the exfiltrated data into output, e.g.:

printf '%s\n' '{{ _external_data.secret.token }}' > src/leak.txt.jinja

3. Host or distribute the template: Make the malicious template available via a Git repository, archive, or local path that a victim would use with Copier.
4. Victim runs Copier: The victim executes copier copy --overwrite src dst (no --UNSAFE flag required). Copier renders the _external_data path, resolves it to the target file (e.g., ../secret.yml relative to dst/), reads it via yaml.safe_load, and injects the contents into the rendering context.
5. Exfiltrate data: The rendered output file (dst/leak.txt) contains the secret value from the traversed file, which the attacker can retrieve if they control the template output or if the victim shares the generated project (GitHub Advisory).

• File System: Unexpected output files in the Copier destination directory containing contents that appear to originate from files outside the project directory (e.g., credentials, tokens, or secrets rendered into generated files).
• File System: Presence of a copier.yml in a template source with _external_data entries referencing paths containing ../ sequences or absolute paths (e.g., /home/user/.ssh/, /etc/, /tmp/).
• Logs: Copier execution logs showing _external_data loading from paths that resolve outside the subproject destination root.
• Process: Copier process accessing files in directories unrelated to the destination project directory during template rendering (GitHub Advisory).

Upgrade Copier to version 9.14.1 or later, which introduces a containment check in _load_external_data() that raises ForbiddenPathError when a resolved _external_data path falls outside the subproject root, unless the --trust/--UNSAFE flag is explicitly provided. As a workaround prior to patching, only run Copier against templates from trusted sources, and manually audit any copier.yml for _external_data entries referencing paths with ../ or absolute paths before execution. The fix was released on March 31, 2026 (Copier v9.14.1 Release, Patch Commit).