CVE-2024-26020

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-26020
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26020.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-26020
Aliases
Related
Published
2024-07-22T15:15:02Z
Modified
2024-09-18T03:26:03.623380Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.

References

Affected packages

Debian:11 / anki

Package

Name
anki
Purl
pkg:deb/debian/anki?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.1.15+dfsg-3
2.1.15+dfsg-4

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/ankitects/anki

Affected ranges

Type
GIT
Repo
https://github.com/ankitects/anki
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected

Affected versions

2.*

2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.20
2.0.21
2.0.22
2.0.24
2.0.25
2.0.26
2.0.27
2.0.28
2.0.29
2.0.30
2.0.31
2.0.32
2.0.33
2.0.34
2.0.35
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.1
2.1.10
2.1.11
2.1.12
2.1.13
2.1.14
2.1.15
2.1.16
2.1.2
2.1.20
2.1.22
2.1.24
2.1.25
2.1.26
2.1.28
2.1.29
2.1.3
2.1.30
2.1.31
2.1.32
2.1.33
2.1.36
2.1.37
2.1.38
2.1.4
2.1.41
2.1.42
2.1.45
2.1.46
2.1.47
2.1.5
2.1.50
2.1.51
2.1.52
2.1.53
2.1.54
2.1.55
2.1.56
2.1.57
2.1.58
2.1.59
2.1.6
2.1.60
2.1.61
2.1.62
2.1.63
2.1.64
2.1.65
2.1.66
2.1.7
2.1.8
2.1.9

23.*

23.10
23.10.1
23.12
23.12.1
23.12beta1
23.12beta2
23.12beta3
23.12rc1

24.*

24.04
24.04beta1
24.04rc1
24.04rc2
24.04rc3