En bref
- CVE-2026-31863 est une vulnérabilité MOYENNE (CVSS 4.4) touchant github.com/anyproto/anytype-cli, github.com/anyproto/anytype-heart, anytype cli (anytype).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.12%, plus élevée que 2.0% des vulnérabilités.
- Correctif : mettre à jour vers 0.1.11, 0.48.4, 0.54.5 ou plus récent.
Description
Impact
The challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to gain access without the 4-digit code.
Affected components:
- Anytype Desktop (all platforms) ≤ v0.48.2
- Anytype-CLI (headless deployments) ≤ v0.1.9
Not affected:
- Anytype mobile apps (iOS, Android) - do not expose a local gRPC server
Who is impacted:
This vulnerability is scoped to localhost. The gRPC and gRPC-Web ports bind to 127.0.0.1 only and are not exposed to the local network or internet.
Exploitation requires:
- Local user-level access to the machine running Anytype
- Discovery of the randomized listening port
- A running Anytype instance
Anytype-CLI headless deployments may be at higher risk only if an administrator has chosen to set up their own reverse proxy and configured it in a way that
exposes gRPC or gRPC-Web ports to an external network. By default, these ports are not externally accessible and there is no built-in mechanism to expose them.
Patches
Workarounds
- Desktop users: No immediate action required. The vulnerability requires existing local access to the machine.
- Anytype-CLI administrators: If using a custom reverse proxy, ensure it does not expose gRPC or gRPC-Web ports to external networks.
NVD description
Anytype Heart is the middleware library for Anytype. The challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to gain access without the 4-digit code. This vulnerability is fixed in anytype-heart 0.48.4, anytype-cli 0.1.11, and Anytype Desktop 0.54.5.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free