medium6.1
CVE-2021-22540
Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering.
Impact
Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dart | Dart Software Development Kit | before 2.12.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/dart-lang/sdk/commit/ce5a1c2392debce967415d4c09359ff2555e3588
- https://github.com/dart-lang/sdk/security/advisories/GHSA-3rfv-4jvg-9522
- https://github.com/dart-lang/sdk/commit/ce5a1c2392debce967415d4c09359ff2555e3588
- https://github.com/dart-lang/sdk/security/advisories/GHSA-3rfv-4jvg-9522