Vulnerability · Published Apr 22, 2021 · Assigned by Google
CVE-2021-22540XSS in Dart SDK
Medium 6.1
In plain English
A medium-severity cross-site scripting in Dart SDK from Google LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)0.7%top 47.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google LLC | Dart SDK | stable – before 2.12.3 |
Weakness: CWE-79
References
- https://github.com/dart-lang/sdk/security/advisories/GHSA-3rfv-4jvg-9522 x_refsource_CONFIRM
- https://github.com/dart-lang/sdk/commit/ce5a1c2392debce967415d4c09359ff2555e3588 x_refsource_CONFIRM