Copier is a library and CLI used to render project templates. Prior to version 9.14.1 its _external_data feature allowed a template to load YAML files using paths under the template’s control. As a result, an attacker could supply a malicious template that references an arbitrary file on the local filesystem, causing the file’s contents to be read, parsed as YAML, and exposed in the rendered output. This vulnerability enables information disclosure by reading any file accessible to the user running Copier and is classed under CWE‑22.

All releases of the Copier library and command‑line interface prior to version 9.14.1 are affected. The security advisory identifies that the issue has been fixed in version 9.14.1, so any installation using an older release is vulnerable.

The CVSS score of 5.5 indicates moderate impact, while the EPSS score of less than 1% suggests that exploitation is unlikely. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to supply or otherwise place a malicious template in a location where the user will load it. Therefore, the attack vector is likely local or via insider or compromised repository access rather than remote exploitation.