CVE-2024-32152

Advisory

Affected versions of the Anki package are vulnerable to Arbitrary File Creation due to a LaTeX blocklist bypass in the LaTeX processing functionality. The LaTeX module in Anki (≤ 24.04) fails to enforce its blocklist properly, allowing specially crafted malicious flashcards to create arbitrary files at a fixed path. An attacker can exploit this by sharing a malicious flashcard that, when imported or rendered by Anki, creates files at predetermined locations on the user’s system, potentially enabling further unwanted actions such as remote code execution.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-q47p-v5rw-v574
• https://github.com/ankitects/anki/commit/06f7aa393d21d7d5dd8039e15d543b73c3346932
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32152