You may be able to get away with a resistor in series with the CMOS IC, perhaps 10K. A more conservative approach would be a resistor with a Schottky diode such as BAT54 to Vdd at the CMOS IC. The PIC programmer can source enough current that a bit of loading is okay.
Both those approaches drive some current into the Vdd rail so you have make sure that there is always sufficient load on Vdd (maybe a power LED or other items that are always powered) so that application of Vpp does not cause the Vdd rail to rise above nominal.
You could also add another pullup resistor at the CMOS chip input and a BAT54 diode to pull the output down.
Finally, a 2N7000 plus pullup resistor is possibly the most elegant solution.
simulate this circuit – Schematic created using CircuitLab
The BAT54 is included to deal with capacitive coupling, and any spike will be absorbed by the decoupling caps.