Arbitrary Command Execution in Anki on Windows Due to URL Scheme Mishandling
CVE-2025-62186

6.7MEDIUM

Key Information:

Vendor

Ankitects

Status
Anki
Vendor
CVE Published:
7 October 2025

What is CVE-2025-62186?

A vulnerability in Anki, prior to version 25.02.5, exposes Windows users to arbitrary command execution risks via improperly handled URL schemes in shared decks. Malicious audio files can exploit this issue, allowing attackers to run commands without user consent when audio is played.

Affected Version(s)

Anki 0 < 25.02.5

References

https://github.com/ankitects/anki/releases/tag/25.02.5

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.