PyPI: anki
CVE-2024-29073
Safety vulnerability ID: SFTY-20240722-74172
Safety legacy ID: pyup.io-78755
Affected versions of the Anki package are vulnerable to Arbitrary File Read due to incomplete LaTeX sanitization that fails to block the `verbatim` package. The Latex handling module overlooks the `verbatim` package during sanitization, allowing specially crafted flashcards to include commands that read arbitrary files. An attacker can exploit this by sharing a malicious flashcard, which, when rendered by Anki 24.04, causes the application to read files on the user’s system, potentially exposing sensitive local data.
Overview
Anki Latex Incomplete Blocklist Vulnerability
Advisory
Affected versions of the Anki package are vulnerable to Arbitrary File Read due to incomplete LaTeX sanitization that fails to block the `verbatim` package. The Latex handling module overlooks the `verbatim` package during sanitization, allowing specially crafted flashcards to include commands that read arbitrary files. An attacker can exploit this by sharing a malicious flashcard, which, when rendered by Anki 24.04, causes the application to read files on the user’s system, potentially exposing sensitive local data.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20240722-74172/CVE-2024-29073
- https://nvd.nist.gov/vuln/detail/CVE-2024-29073
- https://talosintelligence.com/vulnerability_reports/TALOS-2024-1992
- https://github.com/ankitects/anki/pull/3218
- https://skerritt.blog/anki-0day
- https://skii.dev/anki-0day
- https://github.com/ankitects/anki/commit/06f7aa393d21d7d5dd8039e15d543b73c3346932
- https://github.com/advisories/GHSA-x3r6-ccvq-cf5v
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more