CVE-2025-62185

HIGH EPSS 3.5%
Published Oct 7, 20258mo ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Oct 7, 2025 8mo ago
Last Modified Jun 17, 2026 2w ago

Description

In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed for a YouTube link in the deck. The executable name could be youtube-dl.exe or yt-dlp.exe or yt-dlp_x86.exe.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
3.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-427

Affected Products 1

VendorProductVersionRange
ankitectsanki* <25.02.5

References 3

  • github.com https://github.com/ankitects/anki/commit/5080451829505842b16d4a50f398ad44560a3e48
    Patch
  • github.com https://github.com/ankitects/anki/commit/6213c9b6f99ebda181004f8915b92fe3618b939
    Broken Link
  • github.com https://github.com/ankitects/anki/compare/25.02.4...25.02.5
    Patch

Remediation

  • github.com https://github.com/ankitects/anki/commit/5080451829505842b16d4a50f398ad44560a3e48
    Patch
  • github.com https://github.com/ankitects/anki/compare/25.02.4...25.02.5
    Patch