~ / search / GHSA-q47p-v5rw-v574

GHSA-q47p-v5rw-v574

Ankitects Anki LaTeX Blocklist Bypass vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2024-32152

Packages

EcosystemPackageAffectedFixed in
PyPI anki < 24.6 24.6

Details

As written in the advisory (Markdown source, shown as plain text).

A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability.

References

External links from the advisory. They lead to third-party sites.