PT-2026-56267 · Ankitects · Anki

Taviso · Published 2026-07-07 · Updated 2026-07-07 · CVE-2026-59153

NVD

CVSS v4.0

2.1

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting requests to the local server, with severity varying by browser depending on Private Network Access protections. This issue is fixed in version 25.09.3.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2026-59153

Affected Products

Anki

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-59153 · Security Note
• https://github.com/ankitects/anki/commit/858e5689d0e4fd24f74856c7e8f245412694a219 · Note
• https://github.com/ankitects/anki/releases/tag/25.09.3 · Note
• https://github.com/ankitects/anki/security/advisories/GHSA-869j-r97x-hx2g · Note
• https://x.com/taviso/status/2051310678800253318 · Note