CVE-2020-8923

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-8923
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8923.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-8923
Aliases
  • GHSA-hfq3-v9pv-p627
Published
2020-03-26T12:15:12Z
Modified
2026-07-09T02:49:36Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject custom html/javascript (XSS). Mitigation: update your Dart SDK to 2.7.2, and 2.8.0-dev.17.0 for the dev version. If you cannot update, we recommend you review the way you use the affected APIs, and pay special attention to cases where user-provided data is used to populate DOM nodes. Consider using Element.innerText or Node.text to populate DOM elements.

References

Affected packages

Git / github.com/dart-lang/sdk

Affected ranges

Type
GIT
Repo
https://github.com/dart-lang/sdk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1c9356d8990a2a8c90c66097e20cb2f22e5cc267
Introduced
8f8ae9b8c60b9b31bec5d2c247d8ef81b3c6d369
Last Affected
1386600158c9e06f79f7b25998f99bd45cff4477
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:dart:dart_software_development_kit:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev0.0:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev1.0:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev10.0:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev11.0:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev12.0:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev13.0:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev14.0:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev15.0:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev16.0:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev2.0:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev3.0:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev4.0:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev5.0:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev6.0:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev7.0:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev8.0:*:*:*:*:*:*",
        "cpe:2.3:a:dart:dart_software_development_kit:2.8.0:dev9.0:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.7.2"
        },
        {
            "introduced": "2.8.0-dev0\\.0"
        },
        {
            "last_affected": "2.8.0-dev0\\.0"
        },
        {
            "introduced": "2.8.0-dev1\\.0"
        },
        {
            "last_affected": "2.8.0-dev1\\.0"
        },
        {
            "introduced": "2.8.0-dev10\\.0"
        },
        {
            "last_affected": "2.8.0-dev10\\.0"
        },
        {
            "introduced": "2.8.0-dev11\\.0"
        },
        {
            "last_affected": "2.8.0-dev11\\.0"
        },
        {
            "introduced": "2.8.0-dev12\\.0"
        },
        {
            "last_affected": "2.8.0-dev12\\.0"
        },
        {
            "introduced": "2.8.0-dev13\\.0"
        },
        {
            "last_affected": "2.8.0-dev13\\.0"
        },
        {
            "introduced": "2.8.0-dev14\\.0"
        },
        {
            "last_affected": "2.8.0-dev14\\.0"
        },
        {
            "introduced": "2.8.0-dev15\\.0"
        },
        {
            "last_affected": "2.8.0-dev15\\.0"
        },
        {
            "introduced": "2.8.0-dev16\\.0"
        },
        {
            "last_affected": "2.8.0-dev16\\.0"
        },
        {
            "introduced": "2.8.0-dev2\\.0"
        },
        {
            "last_affected": "2.8.0-dev2\\.0"
        },
        {
            "introduced": "2.8.0-dev3\\.0"
        },
        {
            "last_affected": "2.8.0-dev3\\.0"
        },
        {
            "introduced": "2.8.0-dev4\\.0"
        },
        {
            "last_affected": "2.8.0-dev4\\.0"
        },
        {
            "introduced": "2.8.0-dev5\\.0"
        },
        {
            "last_affected": "2.8.0-dev5\\.0"
        },
        {
            "introduced": "2.8.0-dev6\\.0"
        },
        {
            "last_affected": "2.8.0-dev6\\.0"
        },
        {
            "introduced": "2.8.0-dev7\\.0"
        },
        {
            "last_affected": "2.8.0-dev7\\.0"
        },
        {
            "introduced": "2.8.0-dev8\\.0"
        },
        {
            "last_affected": "2.8.0-dev8\\.0"
        },
        {
            "introduced": "2.8.0-dev9\\.0"
        },
        {
            "last_affected": "2.8.0-dev9\\.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

1.*
1.11.0
1.11.0-dev.2.0
1.11.0-dev.3.0
1.11.0-dev.4.0
1.11.0-dev.5.0
1.11.0-dev.5.1
1.11.0-dev.5.2
1.11.0-dev.5.3
1.11.0-dev.5.4
1.11.0-dev.5.5
1.11.0-dev.5.6
1.11.0-dev.5.7
1.11.1
1.11.2
1.11.3
1.12.0
1.12.1
1.12.2
1.13.0
1.13.1
1.13.2
1.14.0
1.14.1
1.14.2
1.15.0
1.16.0
1.16.1
1.17.0
1.17.1
1.18.0
1.18.1
1.19.0
1.19.1
1.20.0
1.20.1
1.21.0
1.21.1
1.22.0
1.22.1
1.23.0
1.24.0
1.24.1
1.24.2
1.24.3
2.*
2.0.0
2.1.0
2.1.1
2.2.0
2.3.0
2.3.1
2.3.2
2.4.0
2.4.1
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.7.0
2.7.1
2.8.0-dev.0.0
2.8.0-dev.1.0
2.8.0-dev.2.0
2.8.0-dev.3.0
2.8.0-dev.4.0
2.8.0-dev.5.0
2.8.0-dev.6.0
2.8.0-dev.7.0
2.8.0-dev.8.0
2.8.0-dev.9.0
2.8.0-dev0\.0
2.8.0-dev10\.0
2.8.0-dev11\.0
2.8.0-dev12\.0
2.8.0-dev13\.0
2.8.0-dev14\.0
2.8.0-dev15\.0
2.8.0-dev16\.0
2.8.0-dev1\.0
2.8.0-dev2\.0
2.8.0-dev3\.0
2.8.0-dev4\.0
2.8.0-dev5\.0
2.8.0-dev6\.0
2.8.0-dev7\.0
2.8.0-dev8\.0
2.8.0-dev9\.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8923.json"