CVE-2026-108723 in answer-me-with-html
Summary
by MITRE • 10/11/2026
answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external files into generated HTML, disclosing them when shared.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in answer-me-with-html versions through 0.5.0 represents a significant security flaw within the command-line interface code block source embedding functionality. This issue stems from an insufficient validation of file paths during the processing of embedded content for HTML generation. Specifically, the localPath function responsible for resolving and validating the target path of linked resources performs checks solely on the textual representation of the path string rather than performing a full resolution that accounts for symbolic links or other filesystem redirections. This oversight creates a critical gap in access control mechanisms when handling user-supplied input within markdown documents processed by the tool.
From a technical perspective, the core defect lies in the failure to canonicalize paths before validation. When an attacker constructs a repository containing a symbolic link that points outside the designated checkout directory or sandboxed environment, the localPath function accepts this path as valid because it only inspects the literal string provided in the markdown source. It does not traverse the symlink to determine its actual destination on the filesystem. Consequently, when the am render command is executed to generate HTML output, the tool proceeds to embed the content of the file referenced by the symbolic link directly into the generated document. This behavior effectively bypasses directory traversal protections that are typically intended to restrict access to files within a specific project scope.
The operational impact of this vulnerability allows for unauthorized information disclosure through cross-site or local file inclusion mechanisms inherent in HTML rendering. An attacker can craft a malicious repository where markdown documents contain code blocks with src attributes pointing to symlinks located outside the working directory. These symlinks might target sensitive configuration files, source code containing secrets, private keys, or other confidential data residing on the host system. When another user clones this repository and runs the rendering command, their local instance of answer-me-with-html will embed the contents of these external files into the resulting HTML output. If this generated HTML is then shared via email, hosted on a web server, or viewed in a browser with certain security contexts, it exposes the sensitive data contained within those external files to anyone who accesses the document.
This vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The failure to resolve symbolic links before validation is a classic example of this weakness category, where input sanitization is incomplete and does not account for all possible ways the operating system might interpret relative or absolute paths. Furthermore, from an adversary perspective, this technique can be mapped to ATT&CK T1083: File and Directory Discovery, as it enables an attacker to enumerate and read files outside of expected boundaries without direct shell access. It also relates to CWE-94: Improper Control of Generation of Code (Code Injection) in the context that arbitrary file content is injected into a generated document structure, potentially leading to further exploitation if combined with other vulnerabilities such as cross-site scripting if the embedded content contains executable scripts and is viewed in an unsafe browser environment.
Mitigation strategies must focus on enforcing strict path canonicalization before any filesystem operations or validations occur. Developers should update the localPath function to resolve all symbolic links using system calls that follow symlinks, ensuring that the final resolved absolute path remains strictly within the allowed directory boundaries defined by the application's security policy. Additionally implementing a whitelist approach for permitted file extensions and directories can provide defense in depth. Users of affected versions are advised to upgrade to version 0.5.1 or later where this issue has been addressed. Until an update is available, users should avoid rendering markdown documents from untrusted sources that may contain code blocks with embedded links pointing to external resources, particularly when operating in shared or multi-user environments where data leakage could have severe consequences for organizational security posture.