Vulnerabilities in pkg:pypi/aqt

PACKAGE
Advisory Identifier: GHSA-869j-r97x-hx2g
Share
Advisory Summary

CVE-2026-59153 is a HIGH anki's local http server does vulnerability (CWE-346: Origin Validation Error) affecting Aqt libraries in the PyPI ecosystem. The issue involves anki's local http server does not sufficiently validate requests. Remediation is available by upgrading affected packages to version 25.9.3.

2 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:pypi/aqt

2 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:pypi/aqt. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-869j-r97x-hx2g CVE-2026-59153 HIGH Anki's local HTTP server does not sufficiently validate requests
GHSA-cw6h-ffmh-x6vh - MODERATE Anki: User scripts in iframes have access to the internal Anki API

CVE-2026-59153 at a Glance

CVE Identifier CVE-2026-59153
GHSA Identifier GHSA-869j-r97x-hx2g
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-346: Origin Validation Error
Affected Product Aqt
Package Ecosystem PyPI
Published Date
Last Updated

How to Fix CVE-2026-59153

To remediate this vulnerability, upgrade all affected Aqt dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

aqt fixed: 25.9.3 
pip install aqt>=25.9.3
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show aqt

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2026-59153, inspect your installed packages using pip:

pip show aqt

Analyze the terminal output to locate any version of Aqt in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 25.9.3), your application is affected.

Note: The pip show aqt command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-346: Origin Validation Error, where the product does not properly verify that the source of data or communication is valid. In Aqt, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Summary Anki launches a local HTTP server to serve media files and web pages for parts of its interface. While the server has a CORS setup, requests from other origins were not blocked, allowing malicious websites to potentially trigger side-effecting requests. ## Browser impact The severity varies by browser because of Private Network Access (PNA), a newer spec that restricts web pages from making requests to localhost/local network addresses: Chrome/Chromium (including Edge, Brave): Largely protected, as Chrome has implemented PNA restrictions for several years and now puts local network access behind a permission prompt. Safari: Hasn't implemented PNA yet, though macOS has some OS-level protections. Firefox: Most vulnerable — hasn't implemented PNA yet, though it's reportedly planned for Firefox 151. ## Patches The issue was fixed as of Anki 25.09.3 ### References https://x.com/taviso/status/2051310678800253318

CVE-2026-59153 Affected Aqt Versions

1 component(s)
Fixed Versions:
25.9.3
Product / Package Ecosystem Affected Versions Fixed Version
aqt
pypi/aqt
PyPI
< 25.9.3
25.9.3

References

GitHub Advisory / Wiki ADVISORY
https://github.com/ankitects/anki/security/advisories/GHSA-869j-r97x-hx2g
NVD — CVE-2026-59153 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59153
Security Fix Commit FIX COMMIT
https://github.com/ankitects/anki/commit/858e5689d0e4fd24f74856c7e8f245412694a219
Aqt Source Repository REPOSITORY
https://github.com/ankitects/anki
Aqt Release RELEASE
https://github.com/ankitects/anki/releases/tag/25.09.3
x.com/taviso/status/20513... WEB
https://x.com/taviso/status/2051310678800253318

Frequently Asked Questions

What is CVE-2026-59153?
CVE-2026-59153 is a security vulnerability in Aqt involving Anki's local HTTP server does not sufficiently validate requests under CWE-346: Origin Validation Error.
Which Aqt versions are affected?
Affected versions include releases prior to 25.9.3 across affected packages: aqt.
What version fixes CVE-2026-59153?
Upgrading to 25.9.3 (or the latest patched release for your respective branch) resolves the vulnerability.
Is aqt affected?
Yes, aqt is affected in releases prior to 25.9.3. Upgrade your dependency to 25.9.3 or later.
What CWE is associated with CVE-2026-59153?
CVE-2026-59153 is classified under CWE-346: Origin Validation Error (The product does not properly verify that the source of data or communication is valid.).
How can I check PyPI dependencies for CVE-2026-59153?
Run the dependency tree command: 'pip show aqt'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-869j-r97x-hx2g",
  "modified" : "2026-07-15T21:58:57Z",
  "published" : "2026-06-19T22:10:57Z",
  "aliases" : [ "CVE-2026-59153" ],
  "summary" : "Anki's local HTTP server does not sufficiently validate requests",
  "details" : "## Summary\n\nAnki launches a local HTTP server to serve media files and web pages for parts of its interface. While the server has a CORS setup, requests from other origins were not blocked, allowing malicious websites to potentially trigger side-effecting requests.\n\n## Browser impact\n\nThe severity varies by browser because of Private Network Access (PNA), a newer spec that restricts web pages from making requests to localhost/local network addresses:\n\nChrome/Chromium (including Edge, Brave): Largely protected, as Chrome has implemented PNA restrictions for several years and now puts local network access behind a permission prompt.\nSafari: Hasn't implemented PNA yet, though macOS has some OS-level protections.\nFirefox: Most vulnerable — hasn't implemented PNA yet, though it's reportedly planned for Firefox 151.\n\n## Patches\n\nThe issue was fixed as of Anki 25.09.3\n\n### References\n\nhttps://x.com/taviso/status/2051310678800253318",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "aqt"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "25.9.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 25.9.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/ankitects/anki/security/advisories/GHSA-869j-r97x-hx2g"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-59153"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ankitects/anki/commit/858e5689d0e4fd24f74856c7e8f245412694a219"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/ankitects/anki"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ankitects/anki/releases/tag/25.09.3"
  }, {
    "type" : "WEB",
    "url" : "https://x.com/taviso/status/2051310678800253318"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22", "CWE-346" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-19T22:10:57Z",
    "nvd_published_at" : "2026-07-07T22:16:54Z"
  }
}