CVE-2026-58266: Anki Arbitrary File Read via Malicious Card Package

Technical summary

CVE-2026-58266 is an origin-confusion vulnerability in Anki's webview communication layer. Anki's frontend communicates with its Rust backend via a localhost API, and iframe-based user scripts (intended to be confined to editor and reviewer contexts) can unexpectedly access this internal API. The vulnerability allows scripts to call exposed methods—notably getImageForOcclusion and potentially others—without the protections that should isolate untrusted content. An attacker can craft a card package with an embedded iframe that runs malicious JavaScript, bypasses the intended script sandbox, and invokes API methods to enumerate and exfiltrate files readable by the Anki process. The attack vector is network-adjacent (requires user interaction to import a malicious deck) and results in confidentiality compromise.

Business impact

For individual users, this vulnerability enables theft of personal data stored on the same system as Anki—study notes, documents, browser credentials, or other sensitive files accessible to the user account. For organizations using Anki for training or educational purposes, compromised card packages could be used to steal intellectual property, research data, or proprietary information. The attack is silent; users have no indication that their files are being read. Organizations distributing custom Anki decks internally should audit their supply chain for compromised packages. Educational institutions may need to review card repositories and user-contributed decks for suspicious packages.

Affected systems

Anki versions prior to 25.09.4 are vulnerable. This affects users on Windows, macOS, and Linux who run affected versions. The vulnerability is triggered only when a user explicitly imports a malicious card package, so systems that do not use Anki or that run version 25.09.4 or later are not at risk. Mobile versions of Anki (AnkiDroid, AnkiWeb) may have different architectures; verify their patch status independently.

Exploitability

The vulnerability requires user interaction—specifically, a user must import a malicious card package—which moderately limits exploitation scope. However, the barrier to delivery is low: an attacker can distribute compromised decks via card-sharing sites, repositories, or forums where Anki users congregate. Once imported, the exploit is reliable and requires no special Anki configuration. The CVSS score of 6.5 (MEDIUM) reflects the requirement for user interaction balanced against high confidentiality impact and network reachability. This is not a zero-click vulnerability, but it is practical to exploit at scale.

Remediation

Update Anki to version 25.09.4 or later immediately. Verify the update via the official Anki downloads page or your package manager. No workaround exists for older versions; patching is the only mitigation. Users should also audit recently imported card decks from untrusted sources and consider re-importing only decks from verified, official repositories. Review any custom decks obtained from third-party sites or user forums, especially those imported just before discovering this advisory.

Patch guidance

Download and install Anki 25.09.4 from the official website (ankiweb.net) or your operating system's package manager. For Linux users: update via your distribution's package manager if available, or download the standalone AppImage or .tar archive. For Windows and macOS users: download the installer from the official site. Verify the checksum if provided. The upgrade is straightforward and does not require special configuration or data migration. Back up your Anki collection before upgrading as a precaution, though the fix does not alter the collection format.

Detection guidance

Monitor for Anki process access to sensitive file paths (e.g., /home/*, /Users/*, C:\Users\) shortly after importing new card decks. Network detection: watch for HTTP(S) traffic from the Anki process to external IP addresses or domains, especially on systems where Anki is typically used offline. Endpoint Detection and Response (EDR) tools should flag unexpected file reads by anki.exe or anki (Python process) targeting system files, documents, or credential stores. Application whitelisting can restrict Anki's network access to known-safe destinations. On systems with card deck import audit logs or application usage monitoring, review imports of decks from non-standard sources.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), the confidentiality impact is HIGH in practical terms: arbitrary file exfiltration is a serious breach of user data. The attack requires user action but targets a legitimate workflow (importing decks), making it socially engineerable. Organizations with sensitive data or users who import decks from community sources should prioritize patching immediately. Individual users with Anki instances that access personal files should also update promptly. The fix is straightforward and poses minimal upgrade risk.

Risk score, explained

CVSS 6.5 (MEDIUM) is justified by: AV:N (network-reachable attack—the malicious deck can be distributed online), AC:L (no special conditions required to craft or deliver the deck), PR:N (no privileges needed), UI:R (requires user interaction to import), S:U (no scope change), C:H (arbitrary file read—confidentiality is fully compromised), I:N (no integrity impact—files are read, not modified), A:N (no availability impact). The score balances the user-interaction requirement against the severity of unrestricted file access and the ease of exploitation.

Frequently asked questions