CVE-2024-26020CWE-74

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04

Critical · published July 22, 2024

CVSS v3.1
9.6
EPSS
15%
Percentile
96.7
In the wild
Unconfirmed
What it is

🚨 A crafted flashcard could unleash any code on your system! This arbitrary script execution vulnerability in Ankitects Anki is as serious as it gets! 🔥 Think of it like a mischievous chef slipping dangerous ingredients into a dish — one poorly constructed flashcard can serve up a malicious meal that could compromise your entire kitchen (aka system). An attacker could send you a seemingly innocent flashcard, but when you open it, they could execute any code they desire! This means they could access sensitive data, manipulate your files, or even take control of your entire system — absolutely devastating!

Put simply

Think of it like a mischievous chef slipping dangerous ingredients into a dish — one poorly constructed flashcard can serve up a malicious meal that could compromise your entire kitchen (aka system). This vulnerability allows attackers to exploit the MPV functionality in Ankitects Anki by sending specially crafted flashcards that trigger arbitrary code execution, potentially leading to severe consequences for users.

What to do

An attacker could send you a seemingly innocent flashcard, but when you open it, they could execute any code they desire! This means they could access sensitive data, manipulate your files, or even take control of your entire system — absolutely devastating! Update Ankitects Anki to version 24.04.1 immediately to patch this critical vulnerability. Be cautious about flashcards from unknown sources until you've secured your system! You’ve got this! Stay proactive, follow these steps, and you’ll keep your system safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.15186 · 96.7th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2024-07-22T14:20Z
EPSS history
Timeline
  • 22 JUL 14:20Z
    An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04
    cvelistv5