GHSA-cw6h-ffmh-x6vh Anki: User scripts in iframes have access to the internal Anki API

• PyPI aqt: < 25.9.4 → fixed in 25.9.4

Summary Anki's webview-based pages communicate with the Rust backend using an internal localhost API. Anki implements measures to prevent user scripts run in the reviewer/editor from accessing this API (https://github.com/ankitects/anki/pull/3925) but it inadvertently allows access to scripts included via iframes in the editor. While overall only a limited set of API methods are exposed, some such as `getImageForOcclusion` can read arbitrary files. CWE: CWE-22 (Path Traversal) Reporter: Bankde (Eakasit) Affected Products | Ecosystem | Package | Affected Versions | | --------- | ------- | ----------------- | | PyPI | `aqt` | `` tags before importing. • Block unexpected outbound network requests from the Anki process at the firewall level. References • Vulnerability report: _Anki arbitrary file read vulnerability (with exfiltration)_ — Bankde (Eakasit) • Affected source: `qt/aqt/mediasrv.py::_handle_local_file_request` • Related prior CVEs: CVE-2024-29073, CVE-2024-32484, CVE-2025-62185, CVE-2025-62187