Arbitrary Script Execution Vulnerability in Anki 24.04
CVE-2024-26020
9.6CRITICAL
What is CVE-2024-26020?
An arbitrary code execution vulnerability has been identified in the MPV functionality of Ankitects Anki version 24.04. By crafting a malicious flashcard, an attacker can exploit this vulnerability to execute arbitrary scripts on the victim's system. This exploitation occurs when a user interacts with a compromised flashcard, potentially allowing attackers to manipulate the host environment or access sensitive information. It is essential for users and administrators of Ankitects Anki to take precautions and implement security measures to mitigate this risk.
Affected Version(s)
Anki 24.04
References
EPSS Score
15% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Discovered by Autumn Bee Skerritt of Cisco Duo Security and Jacob B.