Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-58266 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protections intended to block reviewer and editor scripts. A malicious imported card package with an embedded iframe can use exposed API methods such as getImageForOcclusion to read arbitrary files accessible to the Anki process and exfiltrate them over the network. This issue is fixed in version 25.09.4.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:7.4 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

CNA: [email protected]CVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/ankitects/anki/commit/b2b68d829e853da51b5de8aad6c13b53e90bc20d	[email protected]	Source CodeVendor
https://github.com/ankitects/anki/releases/tag/25.09.4	[email protected]	Release NotesVendor
https://github.com/ankitects/anki/security/advisories/GHSA-cw6h-ffmh-x6vh	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-346	Origin Validation Error	[email protected]

Affected Products

Product	Versions
Anki	<= 25.09.3 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 25.09.4moderate efforthttps://apps.ankiweb.net Workaround:low effort Do not import <code>.apkg</code> files from untrusted sources. Workaround:low effort Inspect <code>.apkg</code> contents (it's a ZIP) for <code>.html</code>/<code>.svg</code> files with <code><script></code> tags before importing. Mitigation:low effort Block unexpected outbound network requests from the Anki process at the firewall level.

Product

Versions

Anki

<= 25.09.3 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 25.09.4moderate efforthttps://apps.ankiweb.net
Workaround:low effort
Do not import <code>.apkg</code> files from untrusted sources.
Workaround:low effort
Inspect <code>.apkg</code> contents (it's a ZIP) for <code>.html</code>/<code>.svg</code> files with <code><script></code> tags before importing.
Mitigation:low effort
Block unexpected outbound network requests from the Anki process at the firewall level.

Change History

2 change records found show changes

Date	Action	Recorded By
Jul 8, 2026	CVE Modified	CISA-ADP
Jul 7, 2026	New CVE Received	[email protected]