PyPI: anki
CVE-2024-26020
Safety vulnerability ID: SFTY-20240722-53191
Safety legacy ID: pyup.io-78749
Affected versions of the Anki package are vulnerable to Code Injection due to improper handling of MPV functionality in flashcards. The MPV component processes user-supplied flashcard content without sufficient sanitization, enabling crafted inputs to execute arbitrary scripts. An attacker can exploit this by distributing a specially crafted flashcard to a user—which the Anki application renders via MPV—resulting in arbitrary code execution within the user's context, potentially leading to full system compromise.
Overview
Ankitects Anki arbitrary script execution vulnerability
Advisory
Affected versions of the Anki package are vulnerable to Code Injection due to improper handling of MPV functionality in flashcards. The MPV component processes user-supplied flashcard content without sufficient sanitization, enabling crafted inputs to execute arbitrary scripts. An attacker can exploit this by distributing a specially crafted flashcard to a user—which the Anki application renders via MPV—resulting in arbitrary code execution within the user's context, potentially leading to full system compromise.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20240722-53191/CVE-2024-26020
- https://nvd.nist.gov/vuln/detail/CVE-2024-26020
- https://talosintelligence.com/vulnerability_reports/TALOS-2024-1993
- https://github.com/ankitects/anki/commit/8d2e8b1e4fa3757581f224b1a57057d0455352ce
- https://skerritt.blog/anki-0day
- https://skii.dev/anki-0day
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1993
- https://github.com/advisories/GHSA-9gq7-p5w9-w899
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more