Michael Lappas

**Name of the Vulnerable Software and Affected Versions** Anki versions prior to 25.02.5 **Description** A specially designed shared deck can place a YouTube downloader executable in the media folder. This executable is then run when a YouTube link is present within the deck. The executable may be named `youtube-dl.exe`, `yt-dlp.exe`, or `yt-dlp x86.exe`. **Recommendations** Update to version 25.02.5 or later.

**Name of the Vulnerable Software and Affected Versions** Anki versions prior to 25.02.5 **Description** A specially crafted shared deck on Windows can lead to the execution of arbitrary commands when playing audio due to improper handling of URL schemes. **Recommendations** Update to version 25.02.5 or later.

**Name of the Vulnerable Software and Affected Versions** Anki versions prior to 25.02.6 **Description** A flaw exists in Anki that allows crafted sound file references to potentially cause files to be written to arbitrary locations on Windows and Linux systems. This occurs because media file pathnames are not necessarily relative to the media folder. **Recommendations** Update to version 25.02.6 or later.