CVE-2026-58266: Anki Information Disclosure Vulnerability

CVE-2026-58266 Overview

Anki is a widely used open-source flashcard application. CVE-2026-58266 affects Anki versions prior to 25.09.4, where webview-based pages communicate with the Rust backend through an internal localhost API. User scripts embedded in editor iframes can reach this API despite protections designed to block reviewer and editor scripts. A malicious imported card package containing an iframe can invoke exposed methods such as getImageForOcclusion to read arbitrary files accessible to the Anki process. Attackers can then exfiltrate the retrieved data over the network. The vulnerability is classified under [CWE-346] Origin Validation Error.

Critical Impact
A crafted Anki deck imported by a victim can read arbitrary local files accessible to the Anki process and exfiltrate them to an attacker-controlled server.

Affected Products

Anki desktop application versions prior to 25.09.4
Anki editor webview components handling imported card packages
Anki internal localhost API endpoints exposed to iframe contexts

Discovery Timeline

2026-07-07 - CVE-2026-58266 published to NVD
2026-07-08 - Last updated in NVD database
Patch released in Anki version 25.09.4 via commit b2b68d8

Technical Details for CVE-2026-58266

Vulnerability Analysis

Anki's desktop client renders card content and editor views inside a Chromium-based webview. The webview communicates with the Rust backend through an HTTP API bound to 127.0.0.1. To restrict which content can call this API, Anki applies Content Security Policy (CSP) rules that block scripts inside reviewer and editor contexts from executing arbitrary code.

However, iframes embedded within editor content did not inherit the intended origin restrictions. A user script running inside an iframe could issue requests to the localhost API and reach endpoints intended for trusted internal use. Methods such as getImageForOcclusion accept file paths and return file contents to the caller, allowing the iframe script to read files the Anki process can access.

Root Cause

The root cause is inadequate origin validation between the trusted Anki UI and untrusted collection media rendered through iframes. Card packages, including shared decks, are user-supplied content but were treated with insufficient sandboxing. The CSP applied to editor views did not fully isolate embedded frames, and the localhost API did not enforce a caller-origin check strong enough to distinguish trusted views from untrusted iframe contexts.

Attack Vector

Exploitation requires a victim to import a malicious card package. The attack chain proceeds as follows:

The attacker crafts an Anki deck containing card media with an embedded iframe.
The victim imports the deck and opens or edits an affected card.
The iframe loads attacker-controlled JavaScript that calls http://127.0.0.1:<port>/ API endpoints.
The script invokes getImageForOcclusion or similar methods to read files by path.
The retrieved contents are sent to an external server controlled by the attacker.

python

     root: str
     # path to file relative to root folder
     path: str
+    # collection media is untrusted user content; add-on web exports are not
+    untrusted: bool = True
+
+
+UNTRUSTED_MEDIA_CSP = "; ".join(
+    (
+        "default-src 'none'",
+        "script-src 'none'",
+        "connect-src 'none'",
+        "object-src 'none'",
+        "frame-src 'none'",
+        "child-src 'none'",
+        "base-uri 'none'",
+        "form-action 'none'",
+        "sandbox",
+    )
+)
+
+
+def _editor_content_security_policy(port: int) -> str:
+    csp_paths = (
+        f"http://127.0.0.1:{port}/_anki/",
+        f"http://127.0.0.1:{port}/_addons/",
+    )
+    return "; ".join((f"script-src {' '.join(csp_paths)}",))

Source: Anki security patch commit b2b68d8. The patch marks collection media as untrusted and applies a strict CSP that blocks scripts, network connections, and frame loading for untrusted content.

Detection Methods for CVE-2026-58266

Indicators of Compromise

Outbound network connections from the Anki process to unexpected external hosts shortly after deck import.
Anki cards or media files containing iframe elements referencing external URLs or inline JavaScript.
Requests originating from Anki's webview to http://127.0.0.1:<port>/ endpoints such as getImageForOcclusion with unusual file path arguments.
Recently imported .apkg or .colpkg files from untrusted or unknown sources.

Detection Strategies

Inspect imported card packages for embedded <iframe> tags or references to remote script sources before opening decks.
Monitor endpoint telemetry for the Anki process making outbound HTTP connections that do not match sync or add-on update destinations.
Compare installed Anki versions against 25.09.4 across managed endpoints and flag older installations.

Monitoring Recommendations

Log process and network activity for the Anki binary and alert on connections outside known-good domains.
Track file read events by the Anki process for sensitive paths outside the user's Anki collection directory.
Review firewall or proxy logs for traffic from workstations to newly registered or low-reputation domains following deck imports.

How to Mitigate CVE-2026-58266

Immediate Actions Required

Upgrade Anki to version 25.09.4 or later on all endpoints.
Do not import Anki decks from untrusted sources until the upgrade is complete.
Audit recently imported card packages and remove any containing embedded iframes or external script references.
Restrict outbound network access from workstations to reduce exfiltration paths for similar client-side flaws.

Patch Information

The fix is included in Anki 25.09.4. See the Anki 25.09.4 release notes and the GitHub Security Advisory GHSA-cw6h-ffmh-x6vh. The patch introduces an UNTRUSTED_MEDIA_CSP policy that blocks scripts, connections, and frame loading for collection media, and tightens the editor CSP to permit scripts only from /_anki/ and /_addons/ paths.

Workarounds

Avoid importing shared decks or card packages from unverified authors until patched.
Run Anki under a restricted user account that has no access to sensitive files or credentials.
Use application allowlisting or host firewall rules to limit Anki's outbound network destinations.

bash

# Verify installed Anki version on Linux/macOS
anki --version

# Example host firewall rule (Linux nftables) restricting Anki outbound traffic
# Replace <uid> with the Anki user's UID and adjust allowed destinations as needed
nft add rule inet filter output meta skuid <uid> ip daddr != { 127.0.0.1, ankiweb.net } drop