CVE-2024-29073CWE-829

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04

Medium · published July 22, 2024

CVSS v3.1
5.3
EPSS
12%
Percentile
96.1
In the wild
Unconfirmed
What it is

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. An attacker can share a flashcard to trigger this vulnerability.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.11826 · 96.1th percentile
Weakness
CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2024-07-22T14:20Z
EPSS history
Timeline
  • 22 JUL 14:20Z
    An vulnerability in the handling of Latex exists in Ankitects Anki 24.04
    cvelistv5