CVE-2026-58266
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A vulnerability in Anki prior to 25.09.4 allows malicious card packages with embedded iframes to access the internal localhost API, enabling reading of arbitrary files accessible to the Anki process and exfiltrating them over the network.
Risk Assessment
The risk involves potential theft of sensitive data by an attacker who can send a crafted card package to the victim, leading to a breach of information confidentiality.
Recommendation
Immediately update Anki to version 25.09.4 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Anki
See all- CVE-2026-64677Medium
In Anki prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read local files through directory traversal.
- CVE-2026-59153Low
Anki prior to version 25.09.3 runs a local HTTP server that does not sufficiently block requests from other origins. A malicious website could send requests to this server, potentially causing side effects.
Original NVD description (English source)
Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protections intended to block reviewer and editor scripts. A malicious imported card package with an embedded iframe can use exposed API methods such as getImageForOcclusion to read arbitrary files accessible to the Anki process and exfiltrate them over the network. This issue is fixed in version 25.09.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS