CVE-2026-108723EPSS p2.7%

CVE-2026-108723CVE-2026-108723

Description

answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external files into generated HTML, disclosing them when shared.

Scoring

CVSS 2.5 ()
VectorCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS0.14% probability of exploitation · percentile 2.7% · 2026-10-17T12:00:28Z
Last modified2026-10-16
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.