CVE-2022-3095

9.8 criticalEPSS 1.2%

The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2022-10-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dart:dart_software_development_kit
flutter:flutter

References

https://github.com/dart-lang/sdk/blob/master/CHANGELOG.md#2182---2022-09-28
https://github.com/dart-lang/sdk/blob/master/CHANGELOG.md#2182---2022-09-28

Check your stack JSON