CVE-2021-22568

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 accesstoken that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend...

CVE-2021-22568

The CVE describes a vulnerability in the Dart toolchain where, during dart pub publish to a third‑party package server, the request is authenticated with an oauth2 access_token that is valid for pub.dev. An attacker obtaining these credentials can impersonate the user on pub.dev. The issue is mit...