Anki
Monthly
Arbitrary file read and exfiltration in Anki prior to 25.09.4 allows a remote attacker to access sensitive files on a victim's system by distributing a maliciously crafted card package (.apkg). The root cause is an origin validation failure (CWE-346) in Anki's internal localhost API, which fails to block iframe-embedded scripts from accessing privileged backend methods such as getImageForOcclusion. Exploitation requires the victim to import the malicious deck; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-origin request forgery against Anki's local HTTP server allows a malicious website to trigger unauthorized side-effecting requests to the application while it is running on the victim's machine. All Anki versions prior to 25.09.3 are affected (CPE: cpe:2.3:a:ankitects:anki:*:*:*:*:*:*:*:*). The practical severity varies significantly by browser: implementations with Private Network Access (PNA) protections block such requests by default, limiting real-world impact to older or less-restrictive browser configurations. No public exploit identified at time of analysis, though security researcher Tavis Ormandy (Google Project Zero) publicly discussed the issue on X, indicating independent researcher awareness.
Anki versions before 25.02.6 fail to confine media filenames referenced by sound/video tags to the media folder, so a crafted [sound:...] reference in an imported note or deck can cause files to be written to arbitrary locations on Windows and Linux. Exploitation is local and requires the victim to import and then play/resolve the malicious media reference, and impact is limited to integrity of the victim's own files under their own write privileges (no confidentiality or availability impact). No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and EPSS is 0.18% (7th percentile), consistent with the LOW real-world priority indicated by the assessed vector.
Arbitrary command execution in Anki versions before 25.02.5 on Windows occurs when a victim imports a crafted shared deck and plays its audio, which triggers mishandling of a URL scheme and lets attacker-controlled payloads run with the user's privileges. Exploitation is local and depends on the user voluntarily obtaining and importing a malicious third-party deck and triggering audio playback (user interaction), and it is confined to Windows clients; the authoritative assessment scores it 7.8 High, reflecting full confidentiality, integrity and availability impact. No public exploit code has been identified at time of analysis, and the EPSS score is only 0.14% (3rd percentile), consistent with the social-engineering prerequisite rather than opportunistic scanning.
Arbitrary code execution in Anki versions before 25.02.5 allows a crafted shared deck to drop a malicious executable named youtube-dl.exe, yt-dlp.exe, or yt-dlp_x86.exe into Anki's media folder, which mpv then launches automatically when the victim plays a card containing a YouTube link. Exploitation is file-based and local (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, base 7.8 HIGH): the attacker must convince the victim to import an untrusted deck and then play the specific malicious card, so the high score reflects full confidentiality, integrity, and availability impact rather than ease of triggering. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and EPSS is very low at 0.15% (4th percentile); a vendor fix is available in Anki 25.02.5.
An issue was discovered in Ankitects Anki through 25.02. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Arbitrary file read and exfiltration in Anki prior to 25.09.4 allows a remote attacker to access sensitive files on a victim's system by distributing a maliciously crafted card package (.apkg). The root cause is an origin validation failure (CWE-346) in Anki's internal localhost API, which fails to block iframe-embedded scripts from accessing privileged backend methods such as getImageForOcclusion. Exploitation requires the victim to import the malicious deck; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-origin request forgery against Anki's local HTTP server allows a malicious website to trigger unauthorized side-effecting requests to the application while it is running on the victim's machine. All Anki versions prior to 25.09.3 are affected (CPE: cpe:2.3:a:ankitects:anki:*:*:*:*:*:*:*:*). The practical severity varies significantly by browser: implementations with Private Network Access (PNA) protections block such requests by default, limiting real-world impact to older or less-restrictive browser configurations. No public exploit identified at time of analysis, though security researcher Tavis Ormandy (Google Project Zero) publicly discussed the issue on X, indicating independent researcher awareness.
Anki versions before 25.02.6 fail to confine media filenames referenced by sound/video tags to the media folder, so a crafted [sound:...] reference in an imported note or deck can cause files to be written to arbitrary locations on Windows and Linux. Exploitation is local and requires the victim to import and then play/resolve the malicious media reference, and impact is limited to integrity of the victim's own files under their own write privileges (no confidentiality or availability impact). No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and EPSS is 0.18% (7th percentile), consistent with the LOW real-world priority indicated by the assessed vector.
Arbitrary command execution in Anki versions before 25.02.5 on Windows occurs when a victim imports a crafted shared deck and plays its audio, which triggers mishandling of a URL scheme and lets attacker-controlled payloads run with the user's privileges. Exploitation is local and depends on the user voluntarily obtaining and importing a malicious third-party deck and triggering audio playback (user interaction), and it is confined to Windows clients; the authoritative assessment scores it 7.8 High, reflecting full confidentiality, integrity and availability impact. No public exploit code has been identified at time of analysis, and the EPSS score is only 0.14% (3rd percentile), consistent with the social-engineering prerequisite rather than opportunistic scanning.
Arbitrary code execution in Anki versions before 25.02.5 allows a crafted shared deck to drop a malicious executable named youtube-dl.exe, yt-dlp.exe, or yt-dlp_x86.exe into Anki's media folder, which mpv then launches automatically when the victim plays a card containing a YouTube link. Exploitation is file-based and local (CVSS:3.1/AV:L/AC:L/PR:N/UI:R, base 7.8 HIGH): the attacker must convince the victim to import an untrusted deck and then play the specific malicious card, so the high score reflects full confidentiality, integrity, and availability impact rather than ease of triggering. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and EPSS is very low at 0.15% (4th percentile); a vendor fix is available in Anki 25.02.5.
An issue was discovered in Ankitects Anki through 25.02. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An vulnerability in the handling of Latex exists in Ankitects Anki 24.04. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.