LOW 2.0 NVD
CVE-2026-108723
answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text witho
answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external files into generated HTML, disclosing them when shared.
References
- https://github.com/QingYunA/answer-me-with-html
- https://github.com/QingYunA/answer-me-with-html/blob/b275eba8d4cc49bcb4bbc28459863f4b49a48
- https://hackmd.io/@haind/answer-me-with-html-code-src-symlink-escape
- https://www.vulncheck.com/advisories/answer-me-with-html-through-0.5.0-symlink-following-i
This low severity vulnerability with a CVSS score of 2.0 was published on 2026-10-11 via NVD.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.