CVE-2026-108723

Name of the Vulnerable Software and Affected Versions answer-me-with-html versions prior to 0.5.1

Description The software contains a link following issue within the CLI code block src= embedding. The localPath() function fails to resolve symlinks, checking only the path text. This allows an attacker to provide a repository containing a symlink that points to a location outside the checkout directory, causing the am render command to embed sensitive external files into the generated HTML.

Recommendations Update answer-me-with-html to a version newer than 0.5.0.