dart-lang vulnerabilities

Products

• flutter 1
• sdk 1

Latest dart-lang CVEs

Newest publication first

1. CVE-2026-27704 Dart SDK and Flutter SDK have Zip slip in Dart Pub package extraction

   Published 2026-02-25

   Medium·CVSS 6.6 EPSS 0.41%

   The Dart and Flutter SDKs provide software development kits for the Dart programming language. In versions of the Dart SDK prior to 3.11.0 and the Flutter SDK prior to version 3.41.0, when the pub client (dart pub and flutter pub) extracts a package in the pub cache, a malicious...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.