CVE-2025-43703

NameCVE-2025-43703
DescriptionAn issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists because of an incomplete fix for CVE-2024-32484.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ankisource(unstable)(not affected)

Notes

- anki <not-affected> (Incomplete fix for CVE-2024-32484 not applied)
https://github.com/ankitects/anki/pull/3925
Issue exists because of an incomplete fix for CVE-2024-32484
Search for package or bug name: Reporting problems