# Are Shared Anki Decks Safe? Anki 26.09.4 Explained

> Anki 26.09.4 fixes critical shared-deck flaws in the editor and on macOS. What changed, who should update, and how to import .apkg files more safely.

HTML: https://schwankiapp.com/guides/are-shared-anki-decks-safe
Markdown: https://schwankiapp.com/guides/are-shared-anki-decks-safe.md

Schwanki · Anki Alternative · Deck Safety

# Are Shared Anki Decks Safe? What Anki 26.09.4's Critical Fixes Mean Before You Import an .apkg

Updated 2026-11-05

By YJ Kim · Facts checked against Anki's forum post, GitHub release notes and apps.ankiweb.net on 5 Nov 2026.

**Short answer:** Shared Anki decks are usually fine to *study*, but an .apkg isn't just plain text. It can contain HTML and media that desktop Anki processes. Anki 26.09.4 (released 4 Nov 2026) fixes two critical issues where a malicious shared deck could run code: one when notes were viewed in the **editor**, and one on **macOS** via "Show in Folder." Update desktop Anki to **26.09.4 or later**, update your OS, and prefer decks from sources you trust.

## What Anki 26.09.4 fixed (in plain English)

Anki 26.09.4 is a security-only update released on 4 November 2026. It closes two ways a shared deck could run code on your computer, and it blocks compromised eMudhra certificates. Nothing else changes.

**Three security fixes in Anki 26.09.4**

| Issue | What it did | Advisory ID | Credit |
| --- | --- | --- | --- |
| Editor + iframes | Shared decks could execute arbitrary code via iframes when viewed in the editor | GHSA-j9v5-m549-cg6c | @DePierre |
| macOS + "Show in Folder" | Shared decks could execute arbitrary commands via specially crafted image filenames when the "Show in Folder" editor action is used | GHSA-gfvm-4968-jp9m | @hyperreality and @Hama1cco |
| eMudhra certificates | Compromised eMudhra intermediate CA certificates are now disallowed, in response to a wider security incident affecting most systems and browsers | — | — |

Anki 26.09.4 is built on 26.09.3, with no UX changes. Anki calls the fixes **critical** and strongly recommends everyone update ASAP on every platform.

The update is available from [apps.ankiweb.net](https://apps.ankiweb.net/), which lists 26.09.4 as the current desktop version for Windows, macOS and Linux. You can also accept the in-app update prompt. Sources: [Anki forum post](https://forums.ankiweb.net/t/anki-26-09-4-released-critical-security-update/74222) and [GitHub release notes](https://github.com/ankitects/anki/releases/) (tag 26.09.4, commit c06370f).

Note: The GHSA advisory IDs above were not available as public pages when checked on 5 Nov 2026. Anki's forum post and GitHub release notes are the primary sources for these details.

## So, are shared Anki decks safe?

Most people download shared decks without trouble. The risk is that an .apkg can carry HTML and media, not just text, and unpatched desktop Anki had bugs in how the editor handled that content.

An Anki Deck Package (.apkg) contains notes, card templates (which include HTML and CSS), media files, and optional scheduling information. For more on what's in the file, see [our guide to exporting with scheduling](https://schwankiapp.com/guides/export-anki-with-scheduling).

The risk comes from **unpatched software + untrusted content**, not from decks being inherently dangerous. There is **no** public data on how many decks, if any, are malicious. This page does not claim AnkiWeb shared decks are compromised.

### Studying vs. editing: why the distinction matters

The iframe issue was reported for notes **viewed in the editor**. The macOS issue requires the **"Show in Folder"** editor action. Both affect editor workflows.

Anki's notes describe both issues in terms of the editor. That doesn't mean other paths are guaranteed safe, so the fix is to update rather than to avoid the editor.

## What to do right now (checklist)

Update desktop Anki to 26.09.4 or newer on every computer you use, then update your operating system.

1. **Check your version:** Open Anki's About screen to see which version you have.
2. **Update:** Accept the in-app update prompt or download from [apps.ankiweb.net](https://apps.ankiweb.net/). The site lists 26.09.4 for Windows 10+ / 11 ARM, macOS 13+ on Apple Silicon or Intel, and Linux.
3. **Update your OS** because of the eMudhra certificate note.
4. **Update before** you open newly downloaded decks in the editor. On a Mac, avoid "Show in Folder" on shared-deck media until you've updated.
5. **Prefer trusted sources:** people you know, course instructors, well-known community decks. Be more careful with random .apkg files from file-sharing links, Discord dumps and the like.
6. **Keep backups** before importing big shared decks (see [our export guide](https://schwankiapp.com/guides/export-anki-with-scheduling)). This is general good practice, not a security fix.

### "I opened a shared deck in the editor before updating — now what?"

Update Anki and the OS now. If you have reason to think a deck was malicious, treat it like any other suspicious download: run your usual security software and follow your OS vendor's guidance.

## A short timeline: Anki's 26.09.x security fixes

26.09.4 isn't the first fix in this series. Several 26.09.x releases addressed how Anki handles content from notes and decks, which is a sign the team is actively hardening it.

**Anki 26.09.x security timeline**

| Version | Date | Security-relevant note |
| --- | --- | --- |
| 26.09 | 14 Sep 2026 | Notes could read local files when viewed in the editor; the "Open image" context menu didn't validate file extensions |
| 26.09.2 | 15 Sep 2026 | Prevented external links in deck descriptions on the overview/congrats screens from manipulating the page in certain cases when clicked. Upgrade-ASAP messaging |
| 26.09.3 | 23 Sep 2026 | Bugfixes, still with "Please upgrade to 26.09+ … important security fixes" messaging |
| 26.09.4 | 4 Nov 2026 | The two critical shared-deck fixes plus the eMudhra CA change |

The takeaway isn't "stop using Anki." It's "stay on the latest version."

## What about mobile and other apps that open Anki decks?

The 26.09.4 notes are about desktop Anki. Other apps that import .apkg files have their own code and their own update cycles, so keep whichever app you use up to date.

AnkiMobile and AnkiDroid are separate apps. We don't know whether they were affected. Check each app's own release notes and keep it updated. For context on AnkiMobile, see [our AnkiMobile comparison](https://schwankiapp.com/vs/ankimobile).

General principle: any app that renders deck HTML is processing content written by someone else. The source still matters.

## Where Schwanki fits (soft)

Schwanki is a phone-first review app. It imports your .apkg or .colpkg exports into an FSRS swipe feed. It is not a security tool.

Schwanki imports .apkg and .colpkg files, keeping scheduling and history when the export includes scheduling and media. It uses FSRS v5 and runs as an installable PWA. Schwanki **never asks for your AnkiWeb password**.

**Importing a deck into Schwanki doesn't make an untrusted deck safe. Only import decks you'd trust in Anki too, and keep desktop Anki updated.**

Try Schwanki with your Anki deck

## Frequently Asked Questions

### Are shared Anki decks safe to download?

Usually, yes, but an .apkg can contain HTML and media, not just text. Anki 26.09.4 (4 Nov 2026) fixed two critical bugs where a malicious shared deck could run code via the desktop editor or, on macOS, the "Show in Folder" action. Update to 26.09.4 or later and prefer decks from sources you trust.

### What did Anki 26.09.4 fix?

Three things: shared decks could execute code via iframes when viewed in the editor (GHSA-j9v5-m549-cg6c); on macOS, crafted image filenames could execute commands via "Show in Folder" (GHSA-gfvm-4968-jp9m); and compromised eMudhra intermediate CA certificates are now blocked. Nothing else changed.

### Do I need to update if I only study and never edit cards?

Yes. Anki recommends that everyone update on every platform. The reported issues involve the editor, but updating is the simple, recommended fix regardless of how you use Anki.

### Is updating Anki enough?

Not completely. Anki says that because of the eMudhra certificate incident, which affects most systems and browsers, you should also fully update your operating system.

### Where do I get Anki 26.09.4?

Accept the in-app update prompt, or download it from apps.ankiweb.net, which lists 26.09.4 as the current desktop version for Windows, macOS and Linux.

### Does importing a deck into Schwanki make it safe?

No. Schwanki is a review app that imports .apkg/.colpkg files. It isn't a security scanner or sandbox. Only import decks you'd trust in Anki, and keep desktop Anki updated.

### Were AnkiMobile or AnkiDroid affected?

Anki's 26.09.4 notes cover desktop Anki. Check each app's own release notes and keep it updated.

Update Anki to 26.09.4+, update your OS, and stick to decks from sources you trust. That covers what Anki's critical fixes ask of you.

## Updated Anki? Import your deck into Schwanki

Import your Anki deck

Learn more about Schwanki

Export Anki with scheduling · Turn PowerPoint Slides into Flashcards · Turn a Whiteboard Photo into Flashcards · Anki alternative