CVE-2025-43703 Security feature bypass in Anki

Medium 6.1 Published 16 Apr 2025 Updated 17 Apr 2025

Attackers can bypass API key restrictions via crafted shared decks, gaining unauthorized access to the internal API and potentially executing code.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-43703?

CVE-2025-43703 is a medium-severity vulnerability in Ankitects Anki, published on 16 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowledge of an API key) through approaches such as scripts or the SRC attribute of an IMG element. NOTE: this issue exists because of an incomplete fix for CVE-2024-32484.

Weakness: CWE-830

Which versions are affected by CVE-2025-43703?

It affects 1 product.

Products include Ankitects Anki.

How do I fix CVE-2025-43703?

No fix has been published for CVE-2025-43703 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-43703 being exploited?

There is no known exploitation of CVE-2025-43703 in the wild and no public exploit code.

Sources

Also known as GHSA-634v-x2r3-jm25, UBUNTU-CVE-2025-43703.