CVE-2026-108723 QingYunA CVE debrief

Who should care

Defenders responsible for answer-me-with-html deployments should assess exposure and verify the affected versions. This includes reviewing code block src= embeddings for potential symlinks and considering compensating controls to prevent unauthorized file disclosure. Defenders should also review relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

CVE-2026-108723 is a link following vulnerability in answer-me-with-html through 0.5.0 that allows attackers to embed readable external files into generated HTML. Defenders should prioritize verifying the affected versions and assessing exposure in their environment.

• Potential unauthorized file disclosure
• Need to verify affected versions and assess exposure
• Possible impact on confidentiality

Technical summary

The am CLI code block src= embedding in answer-me-with-html through 0.5.0 contains a link following vulnerability. LocalPath() checks only path text without resolving symlinks, allowing attackers to ship a repository with a symlink pointing outside the checkout. This issue can lead to potential unauthorized file disclosure. Defenders should prioritize verifying the affected versions of answer-me-with-html and assessing exposure in their environment. The vulnerability allows attackers to embed readable external files into generated HTML.

Defensive priority

Defenders should prioritize verifying the affected versions of answer-me-with-html and assessing exposure in their environment.

Recommended defensive actions

• Verify the version of answer-me-with-html in use and assess exposure
• Review code block src= embeddings for potential symlinks
• Consider implementing compensating controls to prevent unauthorized file disclosure
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or remediation. Defenders should verify the affected versions of answer-me-with-html and assess exposure in their environment. The vulnerability allows attackers to ship a repository with a symlink pointing outside the checkout, embedding readable external files into generated HTML. There is no information on public exploitation, but defenders should prioritize verifying affected versions and assessing exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.