Description
Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protections intended to block reviewer and editor scripts. A malicious imported card package with an embedded iframe can use exposed API methods such as getImageForOcclusion to read arbitrary files accessible to the Anki process and exfiltrate them over the network. This issue is fixed in version 25.09.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ankitects | anki | < 25.09.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | anki | No fix yet | — |
| Ubuntu 22.04 LTS | anki | No fix yet | — |
| Ubuntu 20.04 LTS | anki | No fix yet | — |
| Ubuntu 18.04 LTS | anki | No fix yet | — |
| Ubuntu 16.04 LTS | anki | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | aqt | < 25.9.4 | 25.9.4 | GHSA-cw6h-ffmh-x6vh |