Bidirectional Override in Dart SDK

The Dart SDK doesn't properly handle special Unicode characters that reverse text direction, allowing attackers to hide malicious code in source files that appears harmless to reviewers. This trick can sneak dangerous code past security checks because the code looks safe when viewed normally.

Bidirectional Unicode override characters (CWE-284) in Dart source code can be compiled into different executable behavior than what is visually rendered in editors, enabling an attacker to inject hidden logic that bypasses code review. The vulnerability requires source code access and code reviewer inattention, but results in arbitrary code execution through deceptive presentation of program logic.