CVE-2025-62185: Ankitects Anki

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed for a YouTube link in the deck. The executable name could be youtube-dl.exe or yt-dlp.exe or yt-dlp_x86.exe.

Affected products

• Ankitects Anki: before 25.02.5 (fixed in 25.02.5)

Published 2025-10-07. Last modified 2026-10-08.