Low
Anki's local HTTP server does not sufficiently validate requests
Type: advisorySources: OSV
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting requests to the local server, with severity varying by browser depending on Private Network Access protections. This issue is fixed in version 25.09.3.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-59153
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 20:20 UTC · Revision 1
Source evidence
Anki's local HTTP server does not sufficiently validate requests
core-osv · Original sourcePublished 7 Jul 2026, 21:11 UTC
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting requests to the local server, with severity varying by browser depending on Private Network Access protections. This issue is fixed in version 25.09.3.
osv:CVE-2026-59153
Complete source record
{
"id": "6381a8996a78c3bf6a7875048085b4249ab1d072b1c4cf9ef2994c0134dd6cab",
"url": "https://osv.dev/vulnerability/CVE-2026-59153",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Anki's local HTTP server does not sufficiently validate requests",
"summary": "Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting requests to the local server, with severity varying by browser depending on Private Network Access protections. This issue is fixed in version 25.09.3.",
"evidence": "osv:CVE-2026-59153",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2026-59153",
"aliases": [
"CVE-2026-59153",
"GHSA-869j-r97x-hx2g",
"PYSEC-2026-3459"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/ankitects/anki",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "5d89b44bdd3d0d0e97bd50431b9451ee8ed32c10"
},
{
"fixed": "858e5689d0e4fd24f74856c7e8f245412694a219"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "25.09.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "858e5689d0e4fd24f74856c7e8f245412694a219"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "5d89b44bdd3d0d0e97bd50431b9451ee8ed32c10"
}
],
"source": "REFERENCES_TAG",
"original_tag": "25.09.3"
}
]
}
}
],
"versions": [
"25.09",
"25.09.2",
"25.09.1",
"25.09rc1",
"25.08b5",
"25.08b4",
"25.08b3",
"25.07.5",
"25.07.4",
"25.07.3",
"25.07.3rc1",
"25.08b2",
"25.08b1",
"25.07.2",
"25.07.1",
"25.07",
"25.06b7",
"25.06b6",
"25.06b5",
"25.06b4",
"25.06b1",
"25.05b2",
"25.05b1",
"25.02",
"25.02rc1",
"25.01rc1",
"25.01beta1",
"24.11rc2",
"24.11",
"24.11rc1",
"24.10rc2",
"24.10rc1",
"24.10beta4",
"24.10beta3",
"24.10beta2",
"24.10beta1",
"24.06.3",
"24.06.2",
"24.06.1",
"24.06",
"24.06rc2",
"24.06rc1",
"24.04.2beta1",
"24.04",
"24.04rc3",
"24.04rc2",
"24.04rc1",
"24.04beta1",
"23.12.1",
"23.12",
"23.12rc1",
"23.12beta3",
"23.12beta2",
"23.12beta1",
"23.10.1",
"23.10",
"2.1.66",
"2.1.65",
"2.1.64",
"2.1.63",
"2.1.62",
"2.1.61",
"2.1.60",
"2.1.59",
"2.1.58",
"2.1.57",
"2.1.56",
"2.1.55",
"2.1.54",
"2.1.53",
"2.1.52",
"2.1.51",
"2.1.50",
"2.1.47",
"2.1.46",
"2.1.45",
"2.1.42",
"2.1.41",
"2.1.38",
"2.1.37",
"2.1.36",
"2.1.33",
"2.1.32",
"2.1.31",
"2.1.30",
"2.1.29",
"2.1.28",
"2.1.26",
"2.1.25",
"2.1.24",
"2.1.22",
"2.1.20",
"2.1.16",
"2.1.15",
"2.1.14",
"2.1.13",
"2.1.12",
"2.1.11",
"2.1.10",
"2.1.9",
"2.1.8",
"2.1.7",
"2.1.6",
"2.1.5",
"2.1.4",
"2.1.3",
"2.1.2",
"2.1.1",
"2.1.0",
"2.0.35",
"2.0.34",
"2.0.33",
"2.0.32",
"2.0.29",
"2.0.13",
"2.0.12",
"2.0.11",
"2.0.10",
"2.0.9",
"2.0.8",
"2.0.7",
"2.0.6",
"2.0.5",
"2.0.4"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59153.json"
}
}
],
"modified": "2026-10-28T02:30:23.292513782Z",
"provider": "osv",
"references": [
"https://github.com/ankitects/anki/releases/tag/25.09.3",
"https://x.com/taviso/status/2051310678800253318",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59153.json",
"https://github.com/ankitects/anki/security/advisories/GHSA-869j-r97x-hx2g",
"https://nvd.nist.gov/vuln/detail/CVE-2026-59153",
"https://github.com/ankitects/anki/commit/858e5689d0e4fd24f74856c7e8f245412694a219"
],
"provider_metadata": {
"cwe_ids": [
"CWE-346"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59153.json"
}
},
"related_cves": [
{
"value": "CVE-2026-59153",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 489767,
"published_at": "2026-07-07T21:11:01.808+00:00"
}