Uncontrolled Search Path Element Affecting anki package, versions [,25.2.5)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-ANKI-12304089
- published1 Sept 2025
- disclosed8 Jun 2025
- creditMichael Lappas
Introduced: 8 Jun 2025
CVE NOT AVAILABLE CWE-427 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade anki to version 25.2.5 or higher.
Overview
Affected versions of this package are vulnerable to Uncontrolled Search Path Element via the integration with mpv, an attacker can achieve arbitrary code execution by including a malicious executable within a shared deck.
Note: This vulnerability is specific to Windows operating systems due to the inclusion of the current working directory in the system PATH.