Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-58266
6.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
created 2 months, 2 weeks ago Activity log
  • Created suggestion 2 months, 2 weeks ago
Anki: User scripts in iframes have access to the internal Anki API

Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal localhost API, and user scripts included via iframes in the editor can access this API despite protections intended to block reviewer and editor scripts. A malicious imported card package with an embedded iframe can use exposed API methods such as getImageForOcclusion to read arbitrary files accessible to the Anki process and exfiltrate them over the network. This issue is fixed in version 25.09.4.

Affected products

anki
  • ==< 25.09.4

Matching in nixpkgs

pkgs.anki

Spaced repetition flashcard program

  • nixos-unstable -
    • nixos-unstable-small 26.08
  • nixos-26.05 -

pkgs.anki-bin

Spaced repetition flashcard program

  • nixos-unstable -
    • nixos-unstable-small 26.05
  • nixos-26.05 -

pkgs.anki-sync-server

Standalone official anki sync server

  • nixos-unstable -
    • nixos-unstable-small 26.08
  • nixos-26.05 -

pkgs.ankiAddons.recolor

ReColor your Anki desktop to whatever aesthetic you like

  • nixos-unstable -
    • nixos-unstable-small 3.3
  • nixos-26.05 -
    • nixos-26.05-small 3.3

pkgs.markdown-anki-decks

Tool to convert Markdown files into Anki Decks

  • nixos-unstable -
    • nixos-unstable-small 1.1.1
  • nixos-26.05 -
    • nixos-26.05-small 1.1.1

pkgs.ankiAddons.anki-connect

Enable external applications such as Yomichan to communicate with Anki over a simple HTTP API

  • nixos-unstable -
  • nixos-26.05 -

Package maintainers