CVE-2020-8923
MEDIUM EPSS 23.3%
Published Mar 26, 20206y ago · Modified Jun 17, 20262w ago
6.1 CVSS 3.1
Published Mar 26, 2020 6y ago
Last Modified Jun 17, 2026 2w ago
Description
An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject custom html/javascript (XSS). Mitigation: update your Dart SDK to 2.7.2, and 2.8.0-dev.17.0 for the dev version. If you cannot update, we recommend you review the way you use the affected APIs, and pay special attention to cases where user-provided data is used to populate DOM nodes. Consider using Element.innerText or Node.text to populate DOM elements.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
23.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-79 Cross-site Scripting Injection
Affected Products 18
| Vendor | Product | Version | Range |
|---|---|---|---|
| dart | dart_software_development_kit | * | <2.7.2 |
| dart | dart_software_development_kit | 2.8.0 | any |
| dart | dart_software_development_kit | 2.8.0 | any |
| dart | dart_software_development_kit | 2.8.0 | any |
| dart | dart_software_development_kit | 2.8.0 | any |
| dart | dart_software_development_kit | 2.8.0 | any |
| dart | dart_software_development_kit | 2.8.0 | any |
| dart | dart_software_development_kit | 2.8.0 | any |
| dart | dart_software_development_kit | 2.8.0 | any |
| dart | dart_software_development_kit | 2.8.0 | any |
| dart | dart_software_development_kit | 2.8.0 | any |
| dart | dart_software_development_kit | 2.8.0 | any |
| dart | dart_software_development_kit | 2.8.0 | any |
| dart | dart_software_development_kit | 2.8.0 | any |
| dart | dart_software_development_kit | 2.8.0 | any |
| dart | dart_software_development_kit | 2.8.0 | any |
| dart | dart_software_development_kit | 2.8.0 | any |
| dart | dart_software_development_kit | 2.8.0 | any |
References 1
- github.com https://github.com/dart-lang/sdk/security/advisories/GHSA-hfq3-v9pv-p627
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.