PT-2025-16910 · Ankitects · Anki

Dae · Published 2025-04-16 · Updated 2025-10-09 · CVE-2025-43703

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ankitects Anki versions prior to 25.02

Description The issue allows for attacker-controlled access to the internal API through a crafted shared deck, even without knowledge of an API key. This can be achieved through various methods, including scripts or the SRC attribute of an IMG element.

Recommendations For versions prior to 25.02, update to a version that includes a complete fix for the issue. As a temporary workaround, consider restricting access to shared decks or disabling the internal API until a patch is available. Avoid using crafted shared decks in the affected Ankitects Anki versions until the issue is resolved.

Fix

Weakness Enumeration

CWE-830

Related Identifiers

CVE-2025-43703

Affected Products

Anki

References · 12

• https://github.com/ankitects/anki/pull/3925/commits/24bca15fd3d9dc386916509eb2d4862d1184e709 · Patch
• https://github.com/ankitects/anki/pull/3925 · Patch
• https://osv.dev/vulnerability/CVE-2025-43703 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-43703 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-43703 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-43703 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-43703 · Vendor Advisory
• https://t.me/cveNotify/137984 · Telegram Post
• https://t.me/cvetracker/21814 · Telegram Post
• https://twitter.com/CVEnew/status/1913823771560902676 · Twitter Post
• https://t.me/cvedetector/23201 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1912638940068143183 · Twitter Post