Code Execution Vulnerability in Anki by Ankitects
CVE-2025-62185

6.7MEDIUM

Key Information:

Vendor

Ankitects

Status
Anki
Vendor
CVE Published:
7 October 2025

What is CVE-2025-62185?

In earlier versions of Anki, a vulnerability exists that allows a specially crafted shared deck to drop a malicious executable file into the application's media folder. This executable, which may appear as youtube-dl.exe, yt-dlp.exe, or yt-dlp_x86.exe, is subsequently executed when a specific YouTube link is triggered within the deck. This flaw presents a significant risk by enabling unauthorized command execution in the user's environment, thereby compromising the integrity and security of user systems.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Anki 0 < 25.02.5

References

https://github.com/ankitects/anki/commit/5080451829505842...
https://github.com/ankitects/anki/commit/6213c9b6f99ebda1...
https://github.com/ankitects/anki/compare/25.02.4...25.02.5

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.