In anki, cards are formatted using HTML and displayed using a web browser control. The browser is not appropriately restricted against script injections. Attacker can execute scripts by inserting those into card template, as well as accessing arbitrary local and remote files.

Reproducers:

<a href="javascript:alert('Test')">click</a> -> script execution
<img src="file:///path/to/local/file"/> -> local file access
<img src="http://example.com/path/to/remote/file"/> -> remote file access