25.09.4

hexojs/hexo25.09.4May 8, 2026by andrewsanchez

AI Summary

This is a security release addressing a vulnerability where importing untrusted Anki decks (.apkg files) could read local files. The local media server vulnerability that allowed malicious websites to read local files on Firefox and Safari has also been fixed.

Key Highlights

Fixed local file read vulnerability in untrusted deck imports
Addresses security risk for untrusted files
Thanks to @Bankde, @abdnh, @dae, and @fernandolins for the fix

Full Release Notes

## What's Changed
This is a security release. Please upgrade as soon as possible using `Tools > Upgrade/Downgrade`.

Importing untrusted decks (`.apkg` files) had the ability to read local files. This has now been fixed.

Other fixes and new features will follow in the next beta release.

Many thanks to @Bankde for the excellent report and to @abdnh, @dae, and @fernandolins for the fix! 🙏🏻 

## Installing

- If you're a new user, please grab the latest launcher from https://apps.ankiweb.net
- If you already have the 25.09 launcher, you can use `Tools>Upgrade/Downgrade` inside Anki.
- If you have an older launcher/Anki, please grab the latest launcher first, as the older one may or may not work.