CVE-2026-108723
Received Received - Intake

HTML Link Following via Symlink in answer-me-with-html CLI

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external files into generated HTML, disclosing them when shared.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108723
EUVD
EUVD-2026-96889

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
QingYunA answer-me-with-html 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in answer-me-with-html versions up to 0.5.0. It involves a link following issue where the am CLI code block embeds files using src= without properly resolving symlinks. Attackers can create a repository with a symlink pointing outside the checkout directory. When the am render command processes this, it embeds external files into the generated HTML without checking if they are within the intended directory. This allows sensitive files to be included in the output HTML.

Detection Guidance

This vulnerability involves symlink resolution in the am CLI tool. To detect it, inspect repositories for symlinks in the .am directory or files referenced by src= attributes in code blocks. Check if localPath() resolves symlinks correctly by examining file paths in generated HTML output.

Impact Analysis

If you use answer-me-with-html to generate HTML from markdown, an attacker could trick you into including sensitive files from outside your project directory in the generated HTML. This could lead to unintended disclosure of confidential or sensitive information when the HTML is shared or published. The impact is limited to information disclosure since the vulnerability does not allow code execution or modification of files.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. If sensitive data is embedded in generated HTML and shared, it could result in data breaches, leading to potential fines, legal penalties, or reputational damage depending on the regulatory framework and the nature of the disclosed data.

Mitigation Strategies

Upgrade answer-me-with-html to a version beyond 0.5.0 where the symlink issue is fixed. Avoid using untrusted repositories with the am CLI tool. Review generated HTML files for unexpected external file inclusions before sharing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108723. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart