CVE-2025-62185 PUBLISHED

Assigner: mitre
Reserved: 07.10.2025 Published: 07.10.2025 Updated: 07.10.2025

In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed for a YouTube link in the deck. The executable name could be youtube-dl.exe or yt-dlp.exe or yt-dlp_x86.exe.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 6.7

Attack Vector	Local	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Ankitects
Product	Anki
Versions	Default: unaffected affected from 0 to 25.02.5 (excl.)

References

https://github.com/ankitects/anki/commit/5080451829505842b16d4a50f398ad44560a3e48
https://github.com/ankitects/anki/commit/6213c9b6f99ebda181004f8915b92fe3618b939
https://github.com/ankitects/anki/compare/25.02.4...25.02.5

Problem Types

CWE-427 Uncontrolled Search Path Element CWE