Vulnerability · Published Jul 7, 2026 · Assigned by GitHub_M

CVE-2026-59153Anki's local HTTP server does not sufficiently validate requests

Low 2.1

In plain English

A low-severity security flaw in anki from ankitects. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.1Low

Exploit odds (30 days)0.3%top 81.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting requests to the local server, with severity varying by browser depending on Private Network Access protections. This issue is fixed in version 25.09.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	aqt	25.9.3	GHSA-869j-r97x-hx2g
PyPI	aqt	25.9.3	PYSEC-2026-3459
Ubuntu:22.04:LTS	anki	no fix listed	UBUNTU-CVE-2026-59153
Ubuntu:24.04:LTS	anki	no fix listed	UBUNTU-CVE-2026-59153

Affected products (as reported)

Vendor	Product	Versions
ankitects	anki	< 25.09.3

Weakness: CWE-346 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

https://github.com/ankitects/anki/security/advisories/GHSA-869j-r97x-hx2g x_refsource_CONFIRM
https://github.com/ankitects/anki/commit/858e5689d0e4fd24f74856c7e8f245412694a219 x_refsource_MISC
https://github.com/ankitects/anki/releases/tag/25.09.3 x_refsource_MISC
https://x.com/taviso/status/2051310678800253318 x_refsource_MISC