Critical severity9.6NVD Advisory· Published Jul 22, 2024· Updated Jun 17, 2026

CVE-2024-26020

Description

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
ankiPyPI	< 24.06	24.06

Affected products

ghsa-coords
pkg:pypi/anki
Range: < 24.06
Ankitects/Ankicpe-rescue
Range: 24.04
Ankiweb/Anki
cpe:2.3:a:ankiweb:anki:24.04:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

talosintelligence.com/vulnerability_reports/TALOS-2024-1993nvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-9gq7-p5w9-w899ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-26020ghsaADVISORY
github.com/ankitects/anki/commit/8d2e8b1e4fa3757581f224b1a57057d0455352ceghsaWEB
skerritt.blog/anki-0dayghsaWEB
skii.dev/anki-0dayghsaWEB
www.talosintelligence.com/vulnerability_reports/TALOS-2024-1993nvd

News mentions

No linked articles in our index yet.

cvss	0.624
epss	0.012
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000