CVE-2021-22540CWE-79

CVE-2021-22540: vulnerability in Google LLC Dart SDK

XSS in Dart SDK

Published · Updated

Follow this CVE+ Monitor Dart SDK

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.7%
In short

The Dart SDK before version 2.12.3 has a flaw that allows attackers to inject malicious scripts through DOM clobbering using template tags. This means untrusted content could execute unwanted code in users' browsers.

Technical detail

A validation bypass in dart:html's DOM node creation fails to properly sanitize template tags, allowing DOM clobbering-based XSS attacks. An attacker can craft malicious input containing template elements to inject arbitrary JavaScript; exploitation requires the application to process untrusted input through the vulnerable HTML sanitization logic.

Summary generated and translated by AI from the official description.
Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags.
Affected products
Google LLC · Dart SDK
Related CVEs — Google LLC Dart SDK

In the same product, most dangerous first.

CVE-2022-0451MEDIUMAuth bypass in Dark SDKEPSS 1.0%CVE-2021-22568HIGHDart - Publishing to third-party package repositories may expose pub.dev credentialsEPSS 0.9%CVE-2021-22567MEDIUMBidirectional Override in Dart SDKEPSS 0.6%