CVE-2026-23968

CVE-2026-23968 affects Copier (library and CLI) prior to version 9.11.2. The issue lets a safe-looking template include arbitrary files/directories outside the local template via symlinks when _preserve_symlinks is false, effectively enabling read access to sensitive data. Version 9.11.2 patches ...

algokit (>=0.2.0 <=2.10.0), algorun (>=0.0.1b1 <=0.0.1b4) +37 more potentially affected by CVE-2026-23968 via copier (>=2.3.3 <=9.11.1)

copier PYPI version =2.3.3, =0.2.0, =0.0.1b1, =0.0.1, =0.11.0, =0.31.0, =1.4.14, =0.2.3, =2.0.0, =0.18.0, =0.9.0, =0.10.0, =0.1.1, =0.14.1, =0.1.0, =0.1.10, =0.1.11 and more Source cves: CVE-2026-23968 Source advisory: OSV:GHSA-XJHM-GP88-8PFX...

algokit (>=2.9.0 <=2.10.0), biopipen (>=1.0.0 <=1.3.8) +4 more potentially affected by CVE-2026-23968 via copier (>=9.0.1 <=9.11.1)

copier PYPI version =9.0.1, =2.9.0, =1.0.0, =2.2.2, =1.2.1, =2.14.1, =2.51.0 Source cves: CVE-2026-23968 Source advisory: SNYK:PYTHON-COPIER-15054434...