CVE-2021-22540 XSS in Dart SDK

2021-04-2214:15:17

CWE-79

Google

www.cve.org

0.001 Low

EPSS

Percentile

32.7%

JSON

Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags.

CNA Affected

[
  {
    "product": "Dart SDK",
    "vendor": "Google LLC",
    "versions": [
      {
        "lessThan": "2.12.3",
        "status": "affected",
        "version": "stable",
        "versionType": "custom"
      }
    ]
  }
]