Threats affecting pkg:github/ankimcp/anki-mcp-server-addon

CVE-2026-61546 is a high-severity origin validation error in the ankimcp anki-mcp-server-addon prior to version 0.21.0. The vulnerability arises because the MCP server disables DNS-rebinding protection, allowing malicious web pages to send requests rebinding to the local loopback interface. This enables attackers to initialize the MCP server, enumerate available tools, read local collections, and perform non-destructive note and deck modifications without requiring local network access or local process privileges. The issue is fixed in version 0.21.0.