What’s Vulnerable › Vulnerabilities

CVE-2022-3095: Incorrect parsing of the backslash characters in Dart library

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-27 · updated 2026-06-17
• Weakness: CWE-20

Description

The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue.

Affected products

• Google LLC Dart SDK: before 2.18.0 — fixed in 2.18.0
• Flutter: before 3.3.3 — fixed in 3.3.3

How to fix

Upgrade to a fixed version: Google LLC Dart SDK 2.18.0; Flutter 3.3.3. Check the vendor advisory for mitigations.

References

• https://github.com/dart-lang/sdk/blob/master/CHANGELOG.md#2182---2022-09-28
• https://github.com/dart-lang/sdk/blob/master/CHANGELOG.md#2182---2022-09-28

Get alerted when CVE-2022-3095 or the next vulnerability affects your stack