CVE-2026-108723 Details

A vulnerability exists in the 'answer-me-with-html' tool, specifically in versions through 0.5.0, within the code block 'src=' embedding feature. The issue arises because the 'localPath()' function only checks the path as text without resolving symlinks. This flaw allows attackers to include a repository with a symlink pointing to a file outside the project directory. When the 'am render' command is executed, the tool follows the symlink, reads the external file, and embeds its content into the generated HTML. This inadvertently discloses the information when the page is shared.

The vulnerability can be fixed by modifying the 'readSlice' function in 'src/code.js' to resolve symlinks to their real paths, re-check their containment within the base directory, and run the existing secret-pattern checks on the resolved path before reading the file. This adjustment prevents in-tree symlinks from pointing to files outside the allowed directory.