Ankitects vulnerabilities
We track 4 vulnerabilities in Ankitects products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 7, 2025.
Latest Ankitects vulnerabilities
- 7.8 High severity
Anki: Inclusion of Functionality from Untrusted Control Sphere
Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playing audio because of URL scheme mishandling.
- 7.8 High severity
Anki: Uncontrolled Search Path Element
In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed for a YouTube link in the deck. The executable name could be youtube-dl.exe or yt-dlp.exe or yt-dlp_x86.exe.
- 8.2 High severity
Anki: Improper Neutralization of Input During Web Page Generation
An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flas
- 8.8 High severity
Anki: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.