# Feature Request / Discussion: Safe WebAssembly (WASM) execution in templates (CSP blocks in 25.09.4+)

**URL:** <https://forums.ankiweb.net/t/feature-request-discussion-safe-webassembly-wasm-execution-in-templates-csp-blocks-in-25-09-4/69743>\
**Category:** Development\
**Created:** [May 14, 2026, 1:37pm UTC](https://forums.ankiweb.net/t/feature-request-discussion-safe-webassembly-wasm-execution-in-templates-csp-blocks-in-25-09-4/69743 "2026-05-14T13:37:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![TowelSniffer](https://avatars.discourse-cdn.com/v4/letter/t/7ea924/32.png) [@TowelSniffer](https://forums.ankiweb.net/u/TowelSniffer)\
**Post date:** [May 14, 2026, 1:37pm UTC](https://forums.ankiweb.net/t/feature-request-discussion-safe-webassembly-wasm-execution-in-templates-csp-blocks-in-25-09-4/69743/1 "2026-05-14T13:37:17Z")

</div>

Gday,

With the security updates introduced in 25.09.4, strict Content Security Policy (CSP) enforcement now blocks WebAssembly compilation with the following error:

```auto
Uncaught RuntimeError: Aborted(CompileError: WebAssembly.instantiate(): Refused to compile or instantiate WebAssembly module because ‘unsafe-eval’ is not an allowed source of script…

```

**My Use Case:** I maintain an interactive [chess template](https://github.com/TowelSniffer/Anki-Chess-2.0) that utilizes a local Stockfish engine running within a Web Worker. This allows for things like quick analysis and play vs engine cards. There is an asm version of stockfish.js I can use but it is a fair bit weaker so I would like to avoid this if possible.

I get the need for strict security against malicious shared decks, and my use case is pretty niche, but my question is whether some kind of opt-in solution might be possible. Like allowing users to manually opt-in/trust certain decks or something?

---

<div class="post-metadata">

**Author:** ![abdo](https://sea2.discourse-cdn.com/flex002/user_avatar/forums.ankiweb.net/abdo/32/654_2.png) [@abdo](https://forums.ankiweb.net/u/abdo)\
**Post date:** [May 15, 2026, 5:23pm UTC](https://forums.ankiweb.net/t/feature-request-discussion-safe-webassembly-wasm-execution-in-templates-csp-blocks-in-25-09-4/69743/2 "2026-05-15T17:23:25Z")

</div>

It might be possible in the future to enable this safely for all users when we add sandboxing: [Migrate the reviewing screen to Svelte and sandbox if possible · Issue #3871 · ankitects/anki · GitHub](https://github.com/ankitects/anki/issues/3871)

For now I recommend writing an add-on to bypass CSP for your deck’s assets. You should be able to do that by patching `aqt.mediasrv._handle_local_file_request`

---

<div class="post-metadata">

**Author:** ![TowelSniffer](https://avatars.discourse-cdn.com/v4/letter/t/7ea924/32.png) [@TowelSniffer](https://forums.ankiweb.net/u/TowelSniffer)\
**Post date:** [May 17, 2026, 7:05am UTC](https://forums.ankiweb.net/t/feature-request-discussion-safe-webassembly-wasm-execution-in-templates-csp-blocks-in-25-09-4/69743/3 "2026-05-17T07:05:17Z")

</div>

Thanks @abdo, I will keep an eye on that issue. I already have a companion addon so I will try your suggestion.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex002/uploads/anki2/original/1X/8f1279ababc5879d54e4838989f606cfe55af8c7.jpeg) [@system](https://forums.ankiweb.net/u/system)\
**Post date:** [June 16, 2026, 7:05am UTC](https://forums.ankiweb.net/t/feature-request-discussion-safe-webassembly-wasm-execution-in-templates-csp-blocks-in-25-09-4/69743/4 "2026-06-16T07:05:27Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.