CyberRota Analysis
AI-GeneratedThe vulnerability exists in the am CLI code block of answer-me-with-html versions up to 0.5.0, where the localPath() function inadequately checks path text without resolving symlinks. This flaw allows attackers to create a repository containing a symlink that points to external files, potentially exposing sensitive data when the generated HTML is shared. Organizations utilizing this tool should prioritize remediation to prevent unauthorized data disclosure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external files into generated HTML, disclosing them when shared.