PatchTheCVEanki vulnerabilities and fixes
Recent CVEs affecting anki, with upgrade or downgrade steps. 8 tracked.
anki has 8 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-10-07. Highest priority: CVE-2024-26020 (score 63/100).
- CVE-2025-62185 MEDIUM 6.7 UPGRADE In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media
- CVE-2025-62186 MEDIUM 6.7 UPGRADE Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playi
- CVE-2025-62187 LOW 2.9 UPGRADE In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary l
- CVE-2025-43703 MEDIUM 6.1 UPGRADE An issue was discovered in Ankitects Anki through 25.02
- CVE-2024-32484 HIGH 7.4 DOWNGRADE An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 2
- CVE-2024-32152 LOW 3.1 DOWNGRADE A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04
- CVE-2024-29073 MEDIUM 5.3 DOWNGRADE An vulnerability in the handling of Latex exists in Ankitects Anki 24.04
- CVE-2024-26020 CRITICAL 9.6 DOWNGRADE An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04
FAQ
How do I fix anki vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is anki being exploited right now?
None of the tracked anki CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which anki CVE should I patch first?
CVE-2024-26020 currently ranks highest (63/100): An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04.