CVE-2022-3095 CRITICAL

CVE-2022-3095: Incorrect parsing of the backslash characters in Dart library

Vendor Google Llc
Product Dart
Weakness CWE-20 · Input validation
Published October 27, 2022
Last update April 21, 2025

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue.

Key dates

02Disclosure timeline

October 27, 2022 CVE published
April 21, 2025 Record updated