Skip to content
OpenAdvisories

Ecosystem

Pub

12 known vulnerabilities.

Most affected packages

archive 2 shared_preferences_android 1 http 1 personnummer 1 dio 1 dio_http2_adapter 1 agent_dart 1 serverpod_client 1 serverpod_auth_server 1 jose 1 pubnub 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2026-103030

    Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`

    Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destinati…

    cfug dio dio_http2_adapter Pub
  • High 7.5
    CVE-2026-34240

    jose vulnerable to untrusted JWK header key acceptance during signature verification

    JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk). The vulnerabil…

    appsup-dart jose jose Pub
  • High 8.7
    CVE-2024-48915

    Agent Dart missing certificate verification checks

    Agent Dart is an agent library built for Internet Computer for Dart and Flutter apps. Prior to version 1.0.0-dev.29, certificate verification in `lib/agent/certificate.dart` does not occur properly. During the delegation verification in the `_checkDelegation`…

    AstroxNetwork agent_dart agent_dart Pub
  • High 7.4
    CVE-2024-29887

    Serverpod client accepts any certificate

    Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against en…

    serverpod serverpod serverpod_client Pub
  • High 7.8
    CVE-2023-39137

    Filename spoofing in archive

    An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.

    archive Pub
  • High 7.8
    CVE-2023-39139

    Path traversal in Archive

    An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file.

    archive Pub
  • High 7.5
    CVE-2021-31402

    dio vulnerable to CRLF injection with HTTP method string

    The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669.

    dio Pub