Cross-site scripting in Anki - #VU150787
Published: September 17, 2026
Vulnerability identifier: #VU150787
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript.
The vulnerability exists due to improper neutralization of input during web page generation in the Check Blank Cards tool when rendering note type and card type names as raw HTML. A remote attacker can create a blank card with a malicious name to execute arbitrary JavaScript.
Affected software
Anki
Remediation
Install security update from vendor's website.
Anki - update to 26.05