What’s Vulnerable › Vulnerabilities

CVE-2025-62185

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-07 · updated 2026-10-08
• Weakness: CWE-427

Description

In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed for a YouTube link in the deck. The executable name could be youtube-dl.exe or yt-dlp.exe or yt-dlp_x86.exe.

Affected products

• Ankitects Anki: before 25.02.5 — fixed in 25.02.5

How to fix

Upgrade to a fixed version: Ankitects Anki 25.02.5. Check the vendor advisory for mitigations.

References

• https://github.com/ankitects/anki/commit/5080451829505842b16d4a50f398ad44560a3e48
• https://github.com/ankitects/anki/commit/6213c9b6f99ebda181004f8915b92fe3618b939
• https://github.com/ankitects/anki/compare/25.02.4...25.02.5

Get alerted when CVE-2025-62185 or the next vulnerability affects your stack