CVE-2021-22540: Dart Software Development Kit

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags.

Affected products

• Dart Dart Software Development Kit: before 2.12.3 (fixed in 2.12.3)

Published 2021-04-22. Last modified 2026-06-17.