answer-me-with-html CVE-2026-108723

Exploitation requires the victim to run the am render command on an attacker-supplied repository that contains a code-block src= embedding resolving to a symlink pointing outside the checkout; the flaw is that localPath() validates only the path text and does not resolve symlinks. Concrete limiting factors: (1) local access / attacker-controlled repository content is required (AV:L, AT:P), (2) passive user interaction is mandatory - the victim must choose to render the untrusted repo (UI:P), (3) the targeted external file must be readable by the victim's process, and (4) disclosure only materializes when the generated HTML is subsequently shared or published. Affected versions are answer-me-with-html through 0.5.0.

This is a low-priority, low-real-risk issue despite being a genuine vulnerability. The vendor-supplied CVSS 4.0 base score is only 2.0, and all signals align on low severity: the vector is local (AV:L), requires a specific attack condition (AT:P - a crafted repository), passive user interaction (UI:P - the victim must run am render on untrusted content), and yields only low confidentiality impact (VC:L) with no integrity or availability impact. There is no EPSS score, no CISA KEV listing, and no public exploit code provided in the input - only a technical writeup (hackmd) and the vendor advisory from VulnCheck. No signals conflict; everything points to a niche, low-urgency disclosure flaw. The absence of EPSS and KEV data is consistent with a very recently disclosed, low-footprint tool rather than evidence of stealth exploitation. Treat this as a hygiene fix (upgrade past 0.5.0 when a patch is available), not an emergency. Note: no fix version is stated in the input, so patch availability could not be independently confirmed.

An attacker publishes a repository (or submits a PR/sample project) containing a markdown/code block with a src= embedding that points to a symlink escaping the checkout directory. A victim who runs am render on this repository has readable external files (e.g. SSH keys, config, or system files accessible to their user) silently embedded into the generated HTML, which then discloses those contents when the HTML is published or shared. No public exploit code is identified at time of analysis, though a detailed technical writeup exists.