Vulnerability · Published Mar 26, 2020 · Assigned by Google

CVE-2020-8923XSS in Dart

Medium 5.4

In plain English

A medium-severity cross-site scripting in Dart SDK from Google. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 74.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject custom html/javascript (XSS). Mitigation: update your Dart SDK to 2.7.2, and 2.8.0-dev.17.0 for the dev version. If you cannot update, we recommend you review the way you use the affected APIs, and pay special attention to cases where user-provided data is used to populate DOM nodes. Consider using Element.innerText or Node.text to populate DOM elements.

Affected products (as reported)

Vendor	Product	Versions
Google	Dart SDK	stable – through 2.7.1dev – through 2.8.0-dev.16.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/dart-lang/sdk/security/advisories/GHSA-hfq3-v9pv-p627 x_refsource_CONFIRM