CVE-2025-43703

Published: Apr 16, 2025Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: NVD

Description

An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists because of an incomplete fix for CVE-2024-32484.

Affected (1)

Products: Ankitects: Anki

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ankitects Anki	Up to 25.02

Related CWEs

Inclusion of Web Functionality from an Untrusted Source

The product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.

References (2)

https://github.com/ankitects/anki/pull/3925

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/ankitects/anki/pull/3925/commits/24bca15fd3d9dc386916509eb2d4862d1184e709

Source: cve@mitre.org

Patch

Timeline

No history available yet.