CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2024-26020
High (8.8) in ankiweb anki. EPSS 15% chance of exploitation in the next 30 days. Fixed in anki 24.06.
An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.
Severity
- EPSS
- 15% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
- CWE
- CWE-74
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ankiweb:anki
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9gq7-p5w9-w899 | PyPI | anki | <24.06 | 24.06 |
| PYSEC-2026-1116 | PyPI | anki | <24.06 | 24.06 |