Not rated
CVE-2021-22540 Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering
Description
Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Dart SDK 2.12 | earliest → < 2.12.3 | 2.12.3 |
Other CVEs of Dart SDK
The 4 CVEs of Dart SDK →
CVE-2022-0451
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin…
6.5
Medium
CVE-2021-22567
Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be…
4.6
Medium
CVE-2021-22568
When using the dart pub publish command to publish a package to a third-party package server, the request would be…
8.8
High