CVE-2024-26020: Ankitects Anki arbitrary script execution vulnerability

July 22, 2024 (updated November 4, 2025)

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.

References

github.com/advisories/GHSA-9gq7-p5w9-w899
github.com/ankitects/anki
github.com/ankitects/anki/commit/8d2e8b1e4fa3757581f224b1a57057d0455352ce
nvd.nist.gov/vuln/detail/CVE-2024-26020
skerritt.blog/anki-0day
skii.dev/anki-0day
talosintelligence.com/vulnerability_reports/TALOS-2024-1993

Code Behaviors & Features

Detect and mitigate CVE-2024-26020 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →