CVE-2026-27704

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27704", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-23T17:56:51.202Z", "datePublished": "2026-02-25T15:17:26.243Z", "dateUpdated": "2026-02-25T20:27:35.486Z"}, "containers": {"cna": {"title": "Dart SDK and Flutter SDK have Zip slip in Dart Pub package extraction", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/dart-lang/sdk/security/advisories/GHSA-q739-79rh-vmvp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/dart-lang/sdk/security/advisories/GHSA-q739-79rh-vmvp"}, {"name": "https://github.com/dart-lang/pub/commit/26c6985c742593d081f8b58450f463a584a4203a", "tags": ["x_refsource_MISC"], "url": "https://github.com/dart-lang/pub/commit/26c6985c742593d081f8b58450f463a584a4203a"}], "affected": [{"vendor": "dart-lang", "product": "sdk", "versions": [{"version": "< 3.11.0", "status": "affected"}]}, {"vendor": "dart-lang", "product": "flutter", "versions": [{"version": "< 3.41.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T15:17:26.243Z"}, "descriptions": [{"lang": "en", "value": "The Dart and Flutter SDKs provide software development kits for the Dart programming language. In versions of the Dart SDK prior to 3.11.0 and the Flutter SDK prior to version 3.41.0, when the pub client (`dart pub` and `flutter pub`) extracts a package in the pub cache, a malicious package archive can have files extracted outside the destination directory in the `PUB_CACHE`. A fix has been landed in commit 26c6985c742593d081f8b58450f463a584a4203a. By normalizing the file path before writing file, the attacker can no longer traverse up via a symlink. This patch is released in Dart 3.11.0 and Flutter 3.41.0.vAll packages on pub.dev have been vetted for this vulnerability. New packages are no longer allowed to contain symlinks. The pub client itself doesn't upload symlinks, but duplicates the linked entry, and has been doing this for years. Those whose dependencies are all from pub.dev, third-party repositories trusted to not contain malicious code, or git dependencies are not affected by this vulnerability."}], "source": {"advisory": "GHSA-q739-79rh-vmvp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T20:27:17.958484Z", "id": "CVE-2026-27704", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:27:35.486Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27704", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T20:27:17.958484Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:27:29.464Z"}}], "cna": {"title": "Dart SDK and Flutter SDK have Zip slip in Dart Pub package extraction", "source": {"advisory": "GHSA-q739-79rh-vmvp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "dart-lang", "product": "sdk", "versions": [{"status": "affected", "version": "< 3.11.0"}]}, {"vendor": "dart-lang", "product": "flutter", "versions": [{"status": "affected", "version": "< 3.41.0"}]}], "references": [{"url": "https://github.com/dart-lang/sdk/security/advisories/GHSA-q739-79rh-vmvp", "name": "https://github.com/dart-lang/sdk/security/advisories/GHSA-q739-79rh-vmvp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/dart-lang/pub/commit/26c6985c742593d081f8b58450f463a584a4203a", "name": "https://github.com/dart-lang/pub/commit/26c6985c742593d081f8b58450f463a584a4203a", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The Dart and Flutter SDKs provide software development kits for the Dart programming language. In versions of the Dart SDK prior to 3.11.0 and the Flutter SDK prior to version 3.41.0, when the pub client (`dart pub` and `flutter pub`) extracts a package in the pub cache, a malicious package archive can have files extracted outside the destination directory in the `PUB_CACHE`. A fix has been landed in commit 26c6985c742593d081f8b58450f463a584a4203a. By normalizing the file path before writing file, the attacker can no longer traverse up via a symlink. This patch is released in Dart 3.11.0 and Flutter 3.41.0.vAll packages on pub.dev have been vetted for this vulnerability. New packages are no longer allowed to contain symlinks. The pub client itself doesn't upload symlinks, but duplicates the linked entry, and has been doing this for years. Those whose dependencies are all from pub.dev, third-party repositories trusted to not contain malicious code, or git dependencies are not affected by this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T15:17:26.243Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27704", "state": "PUBLISHED", "dateUpdated": "2026-02-25T20:27:35.486Z", "dateReserved": "2026-02-23T17:56:51.202Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T15:17:26.243Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "sdk", "vendor": "dart-lang", "versions": [{"status": "affected", "version": "< 3.11.0"}]}, {"product": "flutter", "vendor": "dart-lang", "versions": [{"status": "affected", "version": "< 3.41.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dart:dart_software_development_kit:*:*:*:*:*:*:*:*", "matchCriteriaId": "F6068B05-8EC9-45A7-A97B-4071F121A443", "versionEndExcluding": "3.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:flutter:flutter:*:*:*:*:*:*:*:*", "matchCriteriaId": "7244D310-C064-4E17-B0BA-B3FC800333C9", "versionEndExcluding": "3.41.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Dart and Flutter SDKs provide software development kits for the Dart programming language. In versions of the Dart SDK prior to 3.11.0 and the Flutter SDK prior to version 3.41.0, when the pub client (`dart pub` and `flutter pub`) extracts a package in the pub cache, a malicious package archive can have files extracted outside the destination directory in the `PUB_CACHE`. A fix has been landed in commit 26c6985c742593d081f8b58450f463a584a4203a. By normalizing the file path before writing file, the attacker can no longer traverse up via a symlink. This patch is released in Dart 3.11.0 and Flutter 3.41.0.vAll packages on pub.dev have been vetted for this vulnerability. New packages are no longer allowed to contain symlinks. The pub client itself doesn't upload symlinks, but duplicates the linked entry, and has been doing this for years. Those whose dependencies are all from pub.dev, third-party repositories trusted to not contain malicious code, or git dependencies are not affected by this vulnerability."}, {"lang": "es", "value": "Los SDK de Dart y Flutter proporcionan kits de desarrollo de software para el lenguaje de programaci\u00f3n Dart. En versiones del SDK de Dart anteriores a la 3.11.0 y del SDK de Flutter anteriores a la versi\u00f3n 3.41.0, cuando el cliente pub ('dart pub' y 'flutter pub') extrae un paquete en la cach\u00e9 de pub, un archivo de paquete malicioso puede tener archivos extra\u00eddos fuera del directorio de destino en el `PUB_CACHE`. Se ha implementado una correcci\u00f3n en el commit 26c6985c742593d081f8b58450f463a584a4203a. Al normalizar la ruta del archivo antes de escribir el archivo, el atacante ya no puede ascender a trav\u00e9s de un enlace simb\u00f3lico. Este parche se publica en Dart 3.11.0 y Flutter 3.41.0. Todos los paquetes en pub.dev han sido examinados para esta vulnerabilidad. Ya no se permite que los nuevos paquetes contengan enlaces simb\u00f3licos. El propio cliente pub no sube enlaces simb\u00f3licos, sino que duplica la entrada enlazada, y ha estado haciendo esto durante a\u00f1os. Aquellos cuyas dependencias provienen todas de pub.dev, repositorios de terceros de confianza para no contener c\u00f3digo malicioso, o dependencias de git no se ven afectados por esta vulnerabilidad."}], "id": "CVE-2026-27704", "lastModified": "2026-06-17T10:27:32.903", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27704", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T20:27:17.958484Z", "version": "2.0.3"}}]}, "published": "2026-02-25T16:23:26.960", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/dart-lang/pub/commit/26c6985c742593d081f8b58450f463a584a4203a"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/dart-lang/sdk/security/advisories/GHSA-q739-79rh-vmvp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.41.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "flutter", "source": "cna", "vendor": "dart-lang"}, "product": "flutter", "vendor": "dart-lang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.11.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "sdk", "source": "cna", "vendor": "dart-lang"}, "product": "sdk", "vendor": "dart-lang"}], "analysis": {"en": {"generated_at": "2026-04-18T10:42:24.770297+00:00", "value": {"mitigation_remediation": ["Update the Dart SDK to version\u202f3.11.0 or newer and the Flutter SDK to version\u202f3.41.0 or newer.", "Verify that all dependencies are sourced from pub.dev and that no packages contain symlinks; trust only packages that have been vetted by the repository.", "If an immediate upgrade is not possible, audit the local pub cache for symlinks and remove any packages that contain them, or restrict future package installations to use only signed packages from trusted registries."], "summary": {"action": "Immediate Patch", "impact": "Local File Overwrite via Path Traversal"}, "threat_synthesis": {"affected_systems": "Affected are Dart SDK prior to version\u202f3.11.0 and Flutter SDK prior to version\u202f3.41.0. These are distributed by dart\u2011lang and flutter. Packages on pub.dev that include symlinks trigger the flaw; any dependencies that are exclusively from pub.dev, trusted third\u2011party repositories that do not ship malicious code, or git repositories do not trigger the vulnerability.", "description_and_impact": "The Dart and Flutter SDK\u2019s pub client extracts packages into the user\u2019s PUB_CACHE directory. In SDK versions earlier than Dart\u202f3.11.0 and Flutter\u202f3.41.0, the extraction routine did not normalize the file path of items inside a package archive. A malicious package could therefore include a symlink that points to a location outside the intended cache, allowing the pub client to create or overwrite arbitrary files on the host filesystem. This represents a classic path\u2011traversal flaw (CWE\u201122). The vulnerability was addressed in commit\u202f26c6985c742593d081f8b58450f463a584a4203a, where path normalization is performed before writing files, and new packages are prevented from containing symlinks. Consequently, only the older SDK releases remain affected.", "risk_and_exploitability": "CVSS\u202f6.6 denotes medium severity. EPSS below\u202f1\u202f% indicates very low likelihood of exploitation, and the issue is not listed in CISA\u2019s KEV catalog. Exploitation requires the attacker to deliver a malicious package archive, typically by controlling a package on pub.dev or a git repository trusted by the user. Successful exploitation results in local file overwrite, which could compromise build artifacts or introduce malicious code into the codebase."}}}}, "created": "2026-02-26T13:15:53.417846+00:00", "updated": "2026-04-18T10:45:43.668920+00:00", "vendors": ["dart-lang", "dart-lang$PRODUCT$flutter", "dart-lang$PRODUCT$sdk"]}