Every CVE Search/ Get API key

CVE-2024-26020

Ankitects Anki arbitrary script execution vulnerability

9.6 CriticalFix available

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

15.2%Up 15.1 points since Jul 23, 2024
90%50%10%1%

What each source reports

CVE List Score used 9.6

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.

Record
CVE-2024-26020
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
EUVDEUVD-2024-2309 9.6

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.

Record
EUVD-2024-2309
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-9gq7-p5w9-w899 8.6

Ankitects Anki arbitrary script execution vulnerability

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.

Record
GHSA-9gq7-p5w9-w899
CVSS 4.0
8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
NVD 9.6

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.

Record
CVE-2024-26020
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
OSV 9.6

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.

Record
CVE-2024-26020
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
OSVDEBIAN-CVE-2024-26020 8.8

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.

Record
DEBIAN-CVE-2024-26020
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-9gq7-p5w9-w899 8.6

Ankitects Anki arbitrary script execution vulnerability

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.

Record
GHSA-9gq7-p5w9-w899
CVSS 4.0
8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
OSVPYSEC-2026-1116 8.6

Ankitects Anki arbitrary script execution vulnerability

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.

Record
PYSEC-2026-1116
CVSS 4.0
8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-26020 9.6

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.

Record
UBUNTU-CVE-2024-26020
CVSS 3.1
9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
anki
PyPI
 before 24.06
24.06
anki
Debian:11
 All versions, plus listed versions
2.1.15+dfsg-32.1.15+dfsg-4
 None known
anki
PyPI
 before 24.06, plus listed versions
2.1.242.1.252.1.262.1.282.1.29
Show 45 moreShow less
2.1.302.1.312.1.322.1.332.1.342.1.352.1.362.1.372.1.37rc12.1.382.1.38b12.1.38b22.1.38b32.1.38b42.1.392.1.39b12.1.39b22.1.402.1.412.1.41b12.1.41b22.1.41b32.1.41b42.1.41b52.1.41b62.1.41b72.1.422.1.432.1.43b12.1.442.1.44b12.1.452.1.45a12.1.45a22.1.45a32.1.45a42.1.45b12.1.45b22.1.45b32.1.45b42.1.45b52.1.45b62.1.45rc12.1.45rc22.1.46
24.06
anki
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.0.32+dfsg-1
 None known
anki
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.1.0+dfsg~a12-0.12.1.0+dfsg~b24-12.1.0+dfsg~b25-12.1.0+dfsg~b26-12.1.0+dfsg~b27-1
Show 6 moreShow less
2.1.0+dfsg~b29-12.1.0+dfsg~b31-12.1.0+dfsg~b33-12.1.0+dfsg~b34-12.1.0+dfsg~b35-12.1.0+dfsg~b36-1
 None known
anki
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.1.8+dfsg-1ubuntu12.1.15+dfsg-1
 None known
anki
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.1.15+dfsg-32.1.15+dfsg-3ubuntu0.1
 None known
anki
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.1.15+dfsg-3ubuntu12.1.15+dfsg-3ubuntu22.1.15+dfsg-3ubuntu32.1.15+dfsg-3ubuntu42.1.15+dfsg-3ubuntu4.1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-26020 is a critical vulnerability (CVSS 9.6) in Ankitects Anki, published July 22, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 15.2%, the 96th percentile. Fixed in anki 24.06.

References

Show 6 moreShow less
This page doesn't list everything

Left out here: 88 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open