Vulnerabilidades do Ankitects Anki
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Ankitects Anki: 5 registro(s), com versões afetadas e correções.cpe:2.3:a:ankitects:anki
CVE-2026-59153
Baixa · 2.1
CWE-346 07/07/2026
Anki's local HTTP server does not sufficiently validate requests
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting requests to the local server, with severity varying by browser depending on Private Network Access protections. This issue is fixed in version 25.09.3.
CVE-2026-58266
Média · 6.5
CWE-346 07/07/2026
Anki: User scripts in iframes have access to the internal Anki API
Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protections intended to block reviewer and editor scripts. A malicious imported card package with an embedded iframe can use exposed API methods such as getImageForOcclusion to read arbitrary files accessible to the Anki process and exfiltrate them over the network. This issue is fixed in version 25.09.4.
CVE-2025-62187
Baixa · 3.3
CWE-23 07/10/2025
In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written...
In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarily relative to the media folder).
CVE-2025-62186
Alta · 7.8
CWE-829 07/10/2025
Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary...
Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playing audio because of URL scheme mishandling.
CVE-2025-62185
Alta · 7.8
CWE-427 07/10/2025
In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable...
In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed for a YouTube link in the deck. The executable name could be youtube-dl.exe or yt-dlp.exe or yt-dlp_x86.exe.