GHSA-869j-r97x-hx2g: Anki's local HTTP server does not sufficiently validate requests

Anki launches a local HTTP server to serve media files and web pages for parts of its interface. The server fails to validate requests in the following ways:

  1. No sufficient validation of the Origin header.
  2. Some endpoints are vulnerable to path traversal attacks.

This allows malicious websites to exfiltrate local files given a known path.

References

Code Behaviors & Features

Detect and mitigate GHSA-869j-r97x-hx2g with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →