CVE-2024-29073

CVE-2024-29073 is a medium-severity vulnerability affecting Ankitects Anki 24.04, where improper sanitization of Latex in flashcards allows for arbitrary file reads. Specifically, the verbatim Latex package was overlooked during sanitization, enabling a specially crafted flashcard to trigger the flaw. An attacker can exploit this by sharing a malicious flashcard, leading to high confidentiality impact without affecting integrity or availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage regarding this vulnerability.