CVE-2024-32484: Ankitects Anki

High severity, CVSS 8.2. EPSS: 21.5% chance of exploitation in the next 30 days.

An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flashcard to trigger this vulnerability.

Affected products

• Ankitects Anki: version 24.04 only

Published 2024-07-22. Last modified 2026-06-17.