Skip to content
OpenAdvisories

Ecosystem

Pub

12 known vulnerabilities.

Most affected packages

archive 2 shared_preferences_android 1 http 1 personnummer 1 dio 1 dio_http2_adapter 1 agent_dart 1 serverpod_client 1 serverpod_auth_server 1 jose 1 pubnub 1
All Critical High Medium Low Exploited only Public exploit

12 results · Feed

  • High 7.5
    CVE-2026-103030

    Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`

    Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destinati…

    cfug dio dio_http2_adapter Pub
  • High 7.5
    CVE-2026-34240

    jose vulnerable to untrusted JWK header key acceptance during signature verification

    JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk). The vulnerabil…

    appsup-dart jose jose Pub
  • Low 3.0
    GHSA-3hpf-ff72-j67p

    shared_preferences_android vulnerability

    ### Impact Due to some data types not being natively representable for the available storage options, shared_preferences_android serializes and deserializes special string prefixes to store these unrepresentable data types. This allows arbitrary classes to be…

    shared_preferences_android Pub
  • High 8.7
    CVE-2024-48915

    Agent Dart missing certificate verification checks

    Agent Dart is an agent library built for Internet Computer for Dart and Flutter apps. Prior to version 1.0.0-dev.29, certificate verification in `lib/agent/certificate.dart` does not occur properly. During the delegation verification in the `_checkDelegation`…

    AstroxNetwork agent_dart agent_dart Pub
  • High 7.4
    CVE-2024-29887

    Serverpod client accepts any certificate

    Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against en…

    serverpod serverpod serverpod_client Pub
  • Medium 5.3
    CVE-2024-29886

    Improved security for stored password hashes

    Serverpod is an app and web server, built for the Flutter and Dart ecosystem. An issue was identified with the old password hash algorithm that made it susceptible to rainbow attacks if the database was compromised. This vulnerability is fixed by 1.2.6.

    serverpod serverpod serverpod_auth_server Pub
  • Medium 5.9
    CVE-2023-26154

    pubnub Insufficient Entropy vulnerability

    Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions …

    pubnub github.com/pubnub/swift com.pubnub:pubnub pubnub npm Packagist Maven PyPI Go crates.io NuGet RubyGems SwiftURL Pub
  • High 7.8
    CVE-2023-39137

    Filename spoofing in archive

    An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.

    archive Pub
  • High 7.8
    CVE-2023-39139

    Path traversal in Archive

    An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file.

    archive Pub
  • Medium 5.3
    CVE-2023-22963

    personnummer/dart vulnerable to Improper Input Validation

    The personnummer implementation before 3.0.3 for Dart mishandles numbers in which the last four digits match the ^000[0-9]$ regular expression.

    personnummer Pub
  • High 7.5
    CVE-2021-31402

    dio vulnerable to CRLF injection with HTTP method string

    The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669.

    dio Pub
  • Medium 6.1
    CVE-2020-35669 Public exploit

    http before 0.13.3 vulnerable to header injection

    An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request.

    http Pub