CVE-2024-26020

Advisory

Affected versions of the Anki package are vulnerable to Code Injection due to improper handling of MPV functionality in flashcards. The MPV component processes user-supplied flashcard content without sufficient sanitization, enabling crafted inputs to execute arbitrary scripts. An attacker can exploit this by distributing a specially crafted flashcard to a user—which the Anki application renders via MPV—resulting in arbitrary code execution within the user's context, potentially leading to full system compromise.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-9gq7-p5w9-w899
• https://github.com/ankitects/anki/commit/8d2e8b1e4fa3757581f224b1a57057d0455352ce
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26020