Answer Me With Html
Monthly
Symlink-following path handling in the answer-me-with-html `am` CLI (through version 0.5.0) causes `am render` to embed files from outside the repository checkout - potentially SSH keys, config files or other data readable by the victim's process - into the generated HTML, which then leaks them if that output is shared or published. The attack is narrow: an attacker must deliver a crafted repository (local vector, AT:P), the victim must deliberately render it (passive user interaction), and the targeted file must be readable by the victim's process, which is why the CVSS 4.0 base score is only 2.0 (AV:L/AC:L/AT:P/PR:N/UI:P, confidentiality low, no integrity or availability impact). No public exploit code and no confirmed active exploitation were identified at time of analysis; the CVSS vector carries PR:N, so no authentication is required, and our independent assessment rates this as a low-priority, low-real-risk issue despite being a genuine vulnerability.
Symlink-following path handling in the answer-me-with-html `am` CLI (through version 0.5.0) causes `am render` to embed files from outside the repository checkout - potentially SSH keys, config files or other data readable by the victim's process - into the generated HTML, which then leaks them if that output is shared or published. The attack is narrow: an attacker must deliver a crafted repository (local vector, AT:P), the victim must deliberately render it (passive user interaction), and the targeted file must be readable by the victim's process, which is why the CVSS 4.0 base score is only 2.0 (AV:L/AC:L/AT:P/PR:N/UI:P, confidentiality low, no integrity or availability impact). No public exploit code and no confirmed active exploitation were identified at time of analysis; the CVSS vector carries PR:N, so no authentication is required, and our independent assessment rates this as a low-priority, low-real-risk issue despite being a genuine vulnerability.