CVE-2024-26020

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.

References

Affected packages

Git / github.com/ankitects/anki

Affected ranges

Type

GIT

Repo

https://github.com/ankitects/anki

Events

Introduced

Last affected

429bc9e14cefb597646a0e1beac6ef140f226b6f

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "24.04"
        }
    ]
}

Affected versions

2.*

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.15

2.0.16

2.0.17

2.0.18

2.0.20

2.0.21

2.0.22

2.0.24

2.0.25

2.0.26

2.0.27

2.0.28

2.0.29

2.0.30

2.0.31

2.0.32

2.0.33

2.0.34

2.0.35

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.1.0

2.1.1

2.1.10

2.1.11

2.1.12

2.1.13

2.1.14

2.1.15

2.1.16

2.1.2

2.1.20

2.1.22

2.1.24

2.1.25

2.1.26

2.1.28

2.1.29

2.1.3

2.1.30

2.1.31

2.1.32

2.1.33

2.1.36

2.1.37

2.1.38

2.1.4

2.1.41

2.1.42

2.1.45

2.1.46

2.1.47

2.1.5

2.1.50

2.1.51

2.1.52

2.1.53

2.1.54

2.1.55

2.1.56

2.1.57

2.1.58

2.1.59

2.1.6

2.1.60

2.1.61

2.1.62

2.1.63

2.1.64

2.1.65

2.1.66

2.1.7

2.1.8

2.1.9

23.*

23.10

23.10.1

23.12

23.12.1

23.12beta1

23.12beta2

23.12beta3

23.12rc1

24.*

24.04

24.04beta1

24.04rc1

24.04rc2

24.04rc3

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26020.json"