CVE-2024-32152: Ankitects Anki LaTeX Blocklist Bypass vulnerability

July 22, 2024 (updated July 25, 2024)

A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability.

References

github.com/advisories/GHSA-q47p-v5rw-v574
github.com/ankitects/anki
github.com/ankitects/anki/pull/3218
nvd.nist.gov/vuln/detail/CVE-2024-32152
skerritt.blog/anki-0day
skii.dev/anki-0day
talosintelligence.com/vulnerability_reports/TALOS-2024-1994

Code Behaviors & Features

Detect and mitigate CVE-2024-32152 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →