CVE-2026-58266

Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protections intended to block reviewer and editor scripts. A malicious imported card package with an embedded iframe can use exposed API methods such as getImageForOcclusion to read arbitrary files accessible to the Anki process and exfiltrate them over the network. This issue is fixed in version 25.09.4.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/ankitects/anki/commit/b2b68d829e853da51b5de8aad6c13b53e90bc20d
https://github.com/ankitects/anki/releases/tag/25.09.4
https://github.com/ankitects/anki/security/advisories/GHSA-cw6h-ffmh-x6vh

Configurations

No configuration.

History

07 Jul 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-07 22:16

Updated : 2026-07-08 15:28

NVD link : CVE-2026-58266

Mitre link : CVE-2026-58266

CVE.ORG link : CVE-2026-58266

JSON object : View

Products Affected

No product.

CWE

CWE-346

Origin Validation Error

{"id": "CVE-2026-58266", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58266", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T13:23:23.495354Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ankitects", "product": "anki", "versions": [{"status": "affected", "version": "< 25.09.4"}]}]}], "published": "2026-07-07T22:16:54.207", "references": [{"url": "https://github.com/ankitects/anki/commit/b2b68d829e853da51b5de8aad6c13b53e90bc20d", "source": "security-advisories@github.com"}, {"url": "https://github.com/ankitects/anki/releases/tag/25.09.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/ankitects/anki/security/advisories/GHSA-cw6h-ffmh-x6vh", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protections intended to block reviewer and editor scripts. A malicious imported card package with an embedded iframe can use exposed API methods such as getImageForOcclusion to read arbitrary files accessible to the Anki process and exfiltrate them over the network. This issue is fixed in version 25.09.4."}], "lastModified": "2026-07-08T15:28:15.630", "sourceIdentifier": "security-advisories@github.com"}