CVE-2021-22568

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend upgrading past https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8 or beyond version 2.15.0

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L

Weakness enumeration

CWE-255 CWE-668

Affected software

Vendor	Product	Versions
Google LLC	Dart SDK	>= unspecified, < 2.15.0

References

https://github.com/dart-lang/sdk/blob/main/CHANGELOG.mdPatch, Third Party Advisory
https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8Patch, Third Party Advisory
https://github.com/dart-lang/sdk/security/advisories/GHSA-r32f-vhjp-qhj7Issue Tracking
https://github.com/dart-lang/sdk/blob/main/CHANGELOG.mdPatch, Third Party Advisory
https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8Patch, Third Party Advisory
https://github.com/dart-lang/sdk/security/advisories/GHSA-r32f-vhjp-qhj7Issue Tracking

Timeline

Published: Dec 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-225695.5An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out o CVE-2021-22574.1Vulnerability in the Oracle Storage Cloud Software Appliance product of Oracle Storage Gateway (component: Management Console). The supporte CVE-2021-225705.5Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the p CVE-2021-225715.5A local attacker could read files from some other users' SA360 reports stored in the /tmp folder during staging process before the files are CVE-2021-225725.5On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creat CVE-2021-225737.3The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's p CVE-2021-22588.1Vulnerability in the Oracle Projects product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected ar CVE-2021-22598.1Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: India Localization, Results). Supported versions that ar CVE-2021-22608.1Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: iRecruitment). The supported version that is affe CVE-2021-226007.0A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privi CVE-2021-22618.1Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Quotes). Supported versions that are CVE-2021-22628.1Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Endeca). The supported version that is affected is 12.