Ankitects vulnerabilities
Published CVEs affecting Ankitects products: 5 record(s), with severity, exploitation and fixes.
CVE-2026-59153
Low · 2.1
CWE-346 Jul 7, 2026
Anki's local HTTP server does not sufficiently validate requests
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting requests to the local server, with severity varying by browser depending on Private Network Access protections. This issue is fixed in version 25.09.3.
CVE-2026-58266
Medium · 6.5
CWE-346 Jul 7, 2026
Anki: User scripts in iframes have access to the internal Anki API
Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protections intended to block reviewer and editor scripts. A malicious imported card package with an embedded iframe can use exposed API methods such as getImageForOcclusion to read arbitrary files accessible to the Anki process and exfiltrate them over the network. This issue is fixed in version 25.09.4.
CVE-2025-62187
Low · 3.3
CWE-23 Oct 7, 2025
In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written...
In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the media folder).
CVE-2025-62186
High · 7.8
CWE-829 Oct 7, 2025
Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary...
Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playing audio because of URL scheme mishandling.
CVE-2025-62185
High · 7.8
CWE-427 Oct 7, 2025
In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable...
In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed for a YouTube link in the deck. The executable name could be youtube-dl.exe or yt-dlp.exe or yt-dlp_x86.exe.