Vulnerability Intelligence Report
Incorrect parsing of the backslash characters in Dart library
CVE-2022-3095
The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:0.87%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-20 ↗CWE-20 Improper Input Validation
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Google LLC | Dart | stable < 2.18.2 (affected), Flutter < 3.3.3 (affected) |
Threat Intelligence Signals
EPSS Score
0.867%
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Google LLC · Vendor · USA |
| Reserved | 2022-09-02T00:00:00 |
| Published | 2022-10-27T00:00:00 |
| Last Updated | 2025-04-21T13:47:41 |
Community Chatter & Buzz