mirror of
https://github.com/ankitects/anki.git
synced 2025-09-21 15:32:23 -04:00
![]() mpv looks for ytdl on the path, which includes the CWD on Windows.
A malicious shared deck could place an executable called yt-dlp.exe in the
media folder, which mpv would then helpfully invoke the first time
a YouTube link was encountered.
A big thank you to Michael Lappas for the report.
(cherry picked from commit
|
||
---|---|---|
.. | ||
aqt | ||
bundle | ||
icons | ||
mac | ||
tests | ||
tools | ||
.isort.cfg | ||
README.md | ||
runanki.py |
Python's Qt GUI is in aqt/