Is Lang Reactor safe?

Question

Accepted Answer

Lang Reactor is medium risk. Dynamic analysis confirmed that any script running on languagereactor.com can send fully caller-controlled HTTP requests to Anki Connect (localhost:8765) through Language Reactor's background service worker. Anki Connect is a locally-running API for the Anki flashcard application that accepts JSON-RPC commands to add, delete, or query notes. The extension's nonce check — which restricts the same relay capability on YouTube, Netflix, and Amazon — is explicitly disabled for the languagereactor.com domain. Users who have Anki Connect running when they visit languagereactor.com are exposed to unauthorized interaction with their local Anki database by any script executing on that page, including through a supply-chain compromise or cross-site scripting vulnerability on that domain.

Is Language Reactor safe?

Findings