Read the docs
TI-2024-19251 Aliases CVE-2024-29073GHSA-x3r6-ccvq-cf5v

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04.

Priority MEDIUM 62CWE-829Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-829.

Summary

An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. When Latex is sanitized to prevent unsafe commands, the verbatim package, which comes installed by default in many Latex distributions, has been overlooked. A specially crafted flashcard can lead to an arbitrary file read. An attacker can share a flashcard to trigger this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.11826 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed anki (PyPI): 24.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AnkitectsAnki24.04—No fix listedCNA
—anki (PyPI)before 24.624.6Patch availableGHSA-x3r6-ccvq-cf5v
  • Anki VendorAnkitects Affected 24.04 Fixed in — No fix listed CNA
  • anki (PyPI) Vendor— Affected before 24.6 Fixed in 24.6 Patch available GHSA-x3r6-ccvq-cf5v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ankiweb:anki:24.04:*:*:*:*:*:*:*24.04VulnerableAnkiweb
  • cpe:2.3:a:ankiweb:anki:24.04:*:*:*:*:*:*:* Versions 24.04 Vulnerable ·Ankiweb

Remediation

  • Fix · GHSA-x3r6-ccvq-cf5v anki (PyPI) Fixed in 24.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-29073
  2. 2026-10-03 Alias added: GHSA-x3r6-ccvq-cf5v

References

Exploit 1

Advisory 1

Other 5

  • TI-2024-17117 Injection in Ankitects Anki CVSS 3.1CRITICAL 9.6
  • TI-2024-21378 Cross-site scripting in Ankitects Anki CVSS 3.1HIGH 8.2
  • TI-2024-21226 A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki… CVSS 3.1MEDIUM 4.3
  • TI-2025-38504 Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute… CVSS 3.1HIGH 7.8
  • TI-2025-38503 Uncontrolled search path in Ankitects Anki CVSS 3.1HIGH 7.8
  • TI-2026-46223 Anki's local HTTP server is vulnerable to directory traversal attacks CVSS 4.0MEDIUM 5.9
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences