Copier is a library and CLI tool for rendering project templates. Before version 9.14.1, its _external_data feature permitted templates to specify paths for loading YAML files. Because these paths were template-controlled and not properly restricted, an attacker supplying a malicious template could perform a path traversal attack (CWE-22) to read arbitrary local files readable by the user running copier. This could lead to unauthorized disclosure of sensitive information embedded in those files. The vulnerability has been addressed by an official patch in version 9.14.1.

An attacker able to supply or influence templates used by copier can read arbitrary local YAML-parseable files accessible to the user running copier. This results in confidentiality loss of potentially sensitive information. There is no indication of integrity or availability impact. The vulnerability requires local access or the ability to provide malicious templates and user interaction (UI:R).

Upgrade copier to version 9.14.1 or later, where this path traversal vulnerability has been fixed. Users relying on untrusted templates should apply this update promptly to prevent unauthorized local file disclosure. No other mitigations are indicated or required once patched.