Arbitrary Script Execution Vulnerability in Anki 24.04
CVE-2024-26020

9.6CRITICAL

Key Information:

Vendor

Ankitects

Status
Anki
Vendor
CVE Published:
22 July 2024

What is CVE-2024-26020?

An arbitrary code execution vulnerability has been identified in the MPV functionality of Ankitects Anki version 24.04. By crafting a malicious flashcard, an attacker can exploit this vulnerability to execute arbitrary scripts on the victim's system. This exploitation occurs when a user interacts with a compromised flashcard, potentially allowing attackers to manipulate the host environment or access sensitive information. It is essential for users and administrators of Ankitects Anki to take precautions and implement security measures to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Anki 24.04

References

https://talosintelligence.com/vulnerability_reports/TALOS...

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by Autumn Bee Skerritt of Cisco Duo Security and Jacob B.
JSON
.