What is the CVSS score of CVE-2026-27704?

CVE-2026-27704 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Dart Software Development Kit are affected by CVE-2026-27704?

A HIGH severity vulnerability (CVE-2026-27704, CVSS 7.5) affects Dart and Flutter SDKs with no patch currently available.

How to fix or mitigate CVE-2026-27704?

Within 24 hours: Inventory all applications and services built with Dart/Flutter SDKs and assess their exposure level (internet-facing vs. internal). Within 7 days: Implement compensating controls such as enhanced input validation, Web Application Firewall (WAF) rules targeting known attack vectors, and network segmentation to limit blast radius. Within 30 days: Monitor vendor security advisories for patch availability and establish a plan for rapid deployment once released; consider engaging Dart/Flutter security channels for technical guidance.

Dart Software Development Kit CVE-2026-27704

HIGH

Path Traversal (CWE-22)

2026-02-25 security-advisories@github.com

Path Traversal Dart Software Development Kit Flutter Dart

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 25, 2026 - 16:23 nvd

HIGH 7.5

DescriptionGitHub Advisory

The Dart and Flutter SDKs provide software development kits for the Dart programming language. In versions of the Dart SDK prior to 3.11.0 and the Flutter SDK prior to version 3.41.0, when the pub client (dart pub and flutter pub) extracts a package in the pub cache, a malicious package archive can have files extracted outside the destination directory in the PUB_CACHE. A fix has been landed in commit 26c6985c742593d081f8b58450f463a584a4203a. By normalizing the file path before writing file, the attacker can no longer traverse up via a symlink. This patch is released in Dart 3.11.0 and Flutter 3.41.0.vAll packages on pub.dev have been vetted for this vulnerability. New packages are no longer allowed to contain symlinks. The pub client itself doesn't upload symlinks, but duplicates the linked entry, and has been doing this for years. Those whose dependencies are all from pub.dev, third-party repositories trusted to not contain malicious code, or git dependencies are not affected by this vulnerability.

AnalysisAI

The Dart and Flutter SDKs provide software development kits for the Dart programming language. [CVSS 7.5 HIGH]

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Dart Software Development Kit. The Dart and Flutter SDKs provide software development kits for the Dart programming language. In versions of the Dart SDK prior to 3.11.0 and the Flutter SDK prior to version 3.41.0, when the pub client (dart pub and flutter pub) extracts a package in the pub cache, a malicious package archive can have files extracted outside the destination directory in the PUB_CACHE. A fix has been landed in commit 26c6985c742593d081f8b58450f463a584a4203a. By normalizing the file path before writing fi

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.