CVE-2021-22540

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-225437.8An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages be CVE-2021-225457.8An attacker can craft a specific IdaPro *.i64 file that will cause the BinDiff plugin to load an invalid memory offset. This can allow the a CVE-2021-225477.8In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in memory objects larger CVE-2021-225487.8An attacker can change the pointer to untrusted memory to point to trusted memory region which causes copying trusted memory to trusted memo CVE-2021-225497.8An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory. It is recommended to update past 0.6.2 CVE-2021-22558.1Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Authoring). Supported versions that are affecte CVE-2021-225507.8An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave. It is recommended t CVE-2021-225525.5An untrusted memory read vulnerability in Asylo versions up to 0.6.1 allows an untrusted attacker to pass a syscall number in MessageReader CVE-2021-225537.5Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically dispos CVE-2021-225557.8A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain pri CVE-2021-225567.8The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operatio CVE-2021-225577.8SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the S