{"cve":"CVE-2022-3095","nvd":{"published":"2022-10-27T16:15:09.600","modified":"2026-06-17T04:58:50.793","status":"Modified","description":"The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\\' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-20"],"references":["https://github.com/dart-lang/sdk/blob/master/CHANGELOG.md#2182---2022-09-28","https://github.com/dart-lang/sdk/blob/master/CHANGELOG.md#2182---2022-09-28"],"products":["dart:dart_software_development_kit","flutter:flutter"],"source":"nvd","synced_at":"2026-10-19T21:37:08.729216836+00:00"},"epss":{"cve":"CVE-2022-3095","score":0.01164,"percentile":0.67277,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}