Priority MEDIUM 51
The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards.
Dart
Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Dart records in CISA KEVNo Dart vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
7 records in Dart Software Development Kit · all components
TI-2021-05522 CVE-2021-22568
Dart - Publishing to third-party package repositories may expose pub.dev credentials
Priority MEDIUM 40
When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev.
TI-2022-00374 CVE-2022-0451
Auth bypass in Dark SDK
Priority LOW 31
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects.
Priority LOW 29
The Dart and Flutter SDKs provide software development kits for the Dart programming language.
TI-2021-05505 CVE-2021-22540 · GHSA-36mh-f84c-9fqq
XSS in Dart SDK
Priority LOW 28
Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering.
TI-2020-07164 CVE-2020-8923
Cross-site scripting in Google Dart SDK
Priority LOW 27
An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject custom html/javascript…
TI-2021-05521 CVE-2021-22567
Bidirectional Override in Dart SDK
Priority LOW 22
Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a code review by appearing benign.