VulnerabilityModified
CVE-2021-22540
Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering.
MEDIUM 6.1EPSS 0.68%
Does this matter?
Lower severity and a low EPSS score (0.68%). Track it; it rarely justifies an emergency change on its own.
Description
Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.68% probability · 50th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- dart/dart software development kit
- Source
- cve-coordination@google.com
References
- https://github.com/dart-lang/sdk/commit/ce5a1c2392debce967415d4c09359ff2555e3588Patch, Third Party Advisory
- https://github.com/dart-lang/sdk/security/advisories/GHSA-3rfv-4jvg-9522Broken Link
- https://github.com/dart-lang/sdk/commit/ce5a1c2392debce967415d4c09359ff2555e3588Patch, Third Party Advisory
- https://github.com/dart-lang/sdk/security/advisories/GHSA-3rfv-4jvg-9522Broken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.