GitHub Advisoryadvisory · PyPI

GHSA-q47p-v5rw-v574 Ankitects Anki LaTeX Blocklist Bypass vulnerability

LOW Published 2024-07-22 Modified 2024-07-26 Official page ↗
Aliases
CVE-2024-32152
Ecosystem
PyPI
Packages
anki
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-184
Reviewed
2024-07-25

Affected packages

• PyPI anki: < 24.6 → fixed in 24.6

Description

A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. A specially crafted malicious flashcard can lead to an arbitrary file creation at a fixed path. An attacker can share a malicious flashcard to trigger this vulnerability.

Related

Alias · CVE (1)

  • CVE-2024-32152 A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. vulnerability

Weakness · CWE (1)

  • CWE-184 Incomplete List of Disallowed Inputs weakness

References