CVE-2026-59153: Anki Flashcard SSRF Vulnerability

CVE-2026-59153 Overview

Anki, an open source flashcard application, contains a cross-origin request validation flaw in versions prior to 25.09.3. The application runs a local HTTP server to serve media files and interface web pages. Requests originating from other web origins were not adequately blocked before reaching the server. A malicious website visited by an Anki user could send side-effecting requests to the local server. The impact varies depending on the browser's Private Network Access (PNA) protections. The issue is tracked under CWE-346: Origin Validation Error and was fixed in Anki version 25.09.3.

Critical Impact
A malicious website can trigger unauthorized state-changing requests against a user's local Anki HTTP server, with browser-dependent severity.

Affected Products

Anki desktop application versions prior to 25.09.3
The embedded local HTTP media server component (qt/aqt/mediasrv.py)
Deployments where users browse the web while Anki is running

Discovery Timeline

2026-07-07 - CVE-2026-59153 published to NVD
2026-07-08 - Last updated in NVD database
Fix released in Anki 25.09.3 via commit 858e5689d0e4fd24f74856c7e8f245412694a219

Technical Details for CVE-2026-59153

Vulnerability Analysis

Anki launches a local HTTP server bound to the loopback interface to serve media assets and portions of the user interface. The server's request handler in qt/aqt/mediasrv.py performs an allowlist check on the Host header to reject non-local requests. A variable shadowing bug in the allowlist construction weakened this check. The intended behavior was to build a tuple of localhost host prefixes from _LOCALHOST_HOSTS. Instead, the comprehension reused the outer host variable name, overwriting the request's Host header value before it could be validated. This origin validation failure ([CWE-346]) allowed cross-origin requests from browsers to reach protected endpoints under specific browser conditions.

Root Cause

The root cause is a Python variable shadowing defect in handle_request. The generator expression tuple(f"{host}:" for host in _LOCALHOST_HOSTS) rebinds host in the enclosing function scope on some interpreters and, more importantly, produces an allowlist derived from an incorrect variable, defeating the origin check.

Attack Vector

Exploitation requires the victim to run Anki locally and visit an attacker-controlled web page. That page issues fetch or form-submission requests to http://127.0.0.1:<port>/ targeting Anki endpoints. Because the local server did not sufficiently distinguish cross-origin requests, browsers lacking Private Network Access enforcement could deliver side-effecting requests to the Anki server.

python

     if os.environ.get("ANKI_API_HOST") != "0.0.0.0":
         host = request.headers.get("Host", "").lower()
         origin = request.headers.get("Origin", "").lower()
-        allowed_hosts = tuple(f"{host}:" for host in _LOCALHOST_HOSTS)
+        allowed_hosts = tuple(f"{h}:" for h in _LOCALHOST_HOSTS)
         if not any(host.startswith(h) for h in allowed_hosts):
             logger.warning("denied non-local host: %s", host)
             abort(403)

Source: Anki commit 858e5689. The patch renames the loop variable to h, preserving the incoming request's host value for the subsequent startswith allowlist check.

Detection Methods for CVE-2026-59153

Indicators of Compromise

Unexpected HTTP requests to loopback ports used by Anki in local process or proxy logs
Anki logger messages containing denied non-local host: indicating attempted cross-origin access
Browser network telemetry showing fetch calls from public origins to 127.0.0.1 or localhost

Detection Strategies

Inventory endpoints running Anki and identify versions below 25.09.3 via software asset management
Monitor local HTTP traffic to Anki listener ports for requests carrying Origin headers from non-local domains
Review browser extension and proxy logs for outbound requests to loopback addresses immediately following visits to untrusted sites

Monitoring Recommendations

Enable and forward Anki application logs to a central log store for review of denied-host warnings
Alert on process telemetry showing browsers initiating connections to the Anki media server port from unfamiliar tabs
Track browser versions in the fleet to confirm Private Network Access enforcement is active

How to Mitigate CVE-2026-59153

Immediate Actions Required

Upgrade Anki to version 25.09.3 or later on all user endpoints
Restart Anki after upgrade to ensure the patched mediasrv.py handler is loaded
Advise users to close Anki when browsing untrusted websites until patched

Patch Information

The fix is available in Anki release 25.09.3. Technical details are documented in GitHub Security Advisory GHSA-869j-r97x-hx2g and the remediation commit.

Workarounds

Use a browser that enforces Private Network Access, blocking public-to-private origin requests by default
Do not set the ANKI_API_HOST environment variable to 0.0.0.0, which disables the local host check entirely
Restrict outbound browser access to untrusted sites while Anki is running on shared or high-risk workstations

bash

# Verify installed Anki version and confirm it is 25.09.3 or later
anki --version

# Ensure ANKI_API_HOST is not overriding the local-only bind
unset ANKI_API_HOST