Dart
Monthly
Cross-origin redirect handling in the dio_http2_adapter plugin for Dart/Flutter copies sensitive request headers to a different origin, leaking Authorization, Cookie, Cookie2, Proxy-Authorization, Proxy-Authenticate, and WWW-Authenticate values to any server an application is redirected to. All versions from 1.0.0 up to (but excluding) 2.8.0 are affected, and only applications that use Http2Adapter (an optional HTTP/2 plugin, not Dio's default adapter) while sending credentialed requests and following redirects - which is on by default - are exposed; the attacker must control or compromise the contacted server or sit on-path to return the cross-origin Location header. The issue is unauthenticated from the attacker's perspective (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, 7.5, confidentiality-only impact) and there is no public exploit identified at time of analysis and no CISA KEV listing; the vendor-released patch is http2_adapter 2.8.0.
Uncontrolled recursion in the Dart and Java ME bindings of Apache Thrift before 0.25.0 lets a remote, unauthenticated attacker crash or hang a service by sending a Thrift message containing deeply nested or self-referential structures that exhaust the parser's stack. Impact is availability-only (no confidentiality or integrity effect per the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and the vulnerable surface is confined to deployments that deserialize untrusted data using the Dart or Java ME bindings, so most Thrift users on Java SE, C++, Python, or Go are not exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 4.0 base score of 8.7 should be read alongside the narrow binding-specific exposure, which makes real-world priority moderate rather than critical.
Denial of service in Apache Thrift's Dart bindings (all versions before 0.25.0) lets an unauthenticated remote attacker crash or hang a service by sending a Thrift message whose length or size field declares an excessive allocation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, score 8.7) confirms the flaw is remotely reachable without authentication or user interaction, but impact is confined to availability - confidentiality and integrity are explicitly rated N, with no data exposure or code execution described in any source. Only deployments that deserialize attacker-supplied Thrift traffic through the Dart bindings are affected, and no public exploit identified at time of analysis.
The Dart and Flutter SDKs provide software development kits for the Dart programming language. [CVSS 7.5 HIGH]
The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An issue was discovered in the http package through 0.12.2 for Dart. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stack consumption vulnerability in dartwebserver.dll 1.9 and earlier, as used in Dart PowerTCP WebServer for ActiveX and other products, allows remote attackers to cause a denial of service (daemon. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-origin redirect handling in the dio_http2_adapter plugin for Dart/Flutter copies sensitive request headers to a different origin, leaking Authorization, Cookie, Cookie2, Proxy-Authorization, Proxy-Authenticate, and WWW-Authenticate values to any server an application is redirected to. All versions from 1.0.0 up to (but excluding) 2.8.0 are affected, and only applications that use Http2Adapter (an optional HTTP/2 plugin, not Dio's default adapter) while sending credentialed requests and following redirects - which is on by default - are exposed; the attacker must control or compromise the contacted server or sit on-path to return the cross-origin Location header. The issue is unauthenticated from the attacker's perspective (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, 7.5, confidentiality-only impact) and there is no public exploit identified at time of analysis and no CISA KEV listing; the vendor-released patch is http2_adapter 2.8.0.
Uncontrolled recursion in the Dart and Java ME bindings of Apache Thrift before 0.25.0 lets a remote, unauthenticated attacker crash or hang a service by sending a Thrift message containing deeply nested or self-referential structures that exhaust the parser's stack. Impact is availability-only (no confidentiality or integrity effect per the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and the vulnerable surface is confined to deployments that deserialize untrusted data using the Dart or Java ME bindings, so most Thrift users on Java SE, C++, Python, or Go are not exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 4.0 base score of 8.7 should be read alongside the narrow binding-specific exposure, which makes real-world priority moderate rather than critical.
Denial of service in Apache Thrift's Dart bindings (all versions before 0.25.0) lets an unauthenticated remote attacker crash or hang a service by sending a Thrift message whose length or size field declares an excessive allocation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H, score 8.7) confirms the flaw is remotely reachable without authentication or user interaction, but impact is confined to availability - confidentiality and integrity are explicitly rated N, with no data exposure or code execution described in any source. Only deployments that deserialize attacker-supplied Thrift traffic through the Dart bindings are affected, and no public exploit identified at time of analysis.
The Dart and Flutter SDKs provide software development kits for the Dart programming language. [CVSS 7.5 HIGH]
The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
An issue was discovered in the http package through 0.12.2 for Dart. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stack consumption vulnerability in dartwebserver.dll 1.9 and earlier, as used in Dart PowerTCP WebServer for ActiveX and other products, allows remote attackers to cause a denial of service (daemon. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.