Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Anki launches a local HTTP server to serve media files and web pages for parts of its interface. While the server has a CORS setup, requests from other origins were not blocked, allowing malicious websites to potentially trigger side-effecting requests. Browser impact The severity varies by browser because of Private Network Access (PNA), a newer spec that restricts web pages from making requests to localhost/local network addresses: Chrome/Chromium (including Edge, Brave): Largely protected, as Chrome has implemented PNA restrictions for several years and now puts local network access behind a permission prompt. Safari: Hasn't implemented PNA yet, though macOS has some OS-level protections. Firefox: Most vulnerable — hasn't implemented PNA yet, though it's reportedly planned for Firefox 151. Patches The issue was fixed as of Anki 25.09.3 References https://x.com/taviso/status/2051310678800253318
Recommended action: Upgrade to 25.9.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Anki's webview-based pages communicate with the Rust backend using an internal localhost API. Anki implements measures to prevent user scripts run in the reviewer/editor from accessing this API (https://github.com/ankitects/anki/pull/3925) but it inadvertently allows access to scripts included via iframes in the editor. While overall only a limited set of API methods are exposed, some such as getImageForOcclusion can read arbitrary files. CWE: CWE-22 (Path Traversal) Reporter: Bankde (Eakasit) Affected Products | Ecosystem | Package | Affected Versions | | --------- | ------- | ----------------- | | PyPI | aqt | <= 25.09.3 | Impact Any desktop Anki user (Windows, macOS, Linux) who imports an untrusted .apkg and views card with an embedded iframe is vulnerable. No special configuration is required. The attacker can read any file accessible to the Anki process and exfiltrate its contents over the network. Patches A patch is available in 25.09.4 Workarounds - Do not import .apkg…
Recommended action: Upgrade to 25.9.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.