Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/anyproto/anytype-heart

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 3.6GoPublished

    Anytype Heart's gRPC API client challenge verification can be bypassed on localhost

    CVE-2026-31863 · GHSA-vv3h-7qwr-722v

    Affected
    • Go github.com/anyproto/anytype-heart < 0.48.4
    Fixed in
    0.48.4· Vendor fix available
    Issue
    Impact The challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to gain access without the 4-digit code. Affected components: - Anytype Desktop (all platforms) ≤ v0.48.2 - Anytype-CLI (headless deployments) ≤ v0.1.9 Not affected: - Anytype mobile apps (iOS, Android) - do not expose a local gRPC server Who is impacted: This vulnerability is scoped to localhost. The gRPC and gRPC-Web ports bind to 127.0.0.1 only and are not exposed to the local network or internet. Exploitation requires: - Local user-level access to the machine running Anytype - Discovery of the randomized listening port - A running Anytype instance Anytype-CLI headless deployments may be at higher risk only if an administrator has chosen to set up their own reverse proxy and configured it in a way that exposes gRPC or gRPC-Web ports to an external network. By default, these ports are not externally accessible and there is no built-in mechanism to expose them. Patches -…

    Recommended action: Upgrade to 0.48.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →