CVE-2026-27704

{"id": "CVE-2026-27704", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-02-25T16:23:26.960", "references": [{"url": "https://github.com/dart-lang/pub/commit/26c6985c742593d081f8b58450f463a584a4203a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/dart-lang/sdk/security/advisories/GHSA-q739-79rh-vmvp", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The Dart and Flutter SDKs provide software development kits for the Dart programming language. In versions of the Dart SDK prior to 3.11.0 and the Flutter SDK prior to version 3.41.0, when the pub client (`dart pub` and `flutter pub`) extracts a package in the pub cache, a malicious package archive can have files extracted outside the destination directory in the `PUB_CACHE`. A fix has been landed in commit 26c6985c742593d081f8b58450f463a584a4203a. By normalizing the file path before writing file, the attacker can no longer traverse up via a symlink. This patch is released in Dart 3.11.0 and Flutter 3.41.0.vAll packages on pub.dev have been vetted for this vulnerability. New packages are no longer allowed to contain symlinks. The pub client itself doesn't upload symlinks, but duplicates the linked entry, and has been doing this for years. Those whose dependencies are all from pub.dev, third-party repositories trusted to not contain malicious code, or git dependencies are not affected by this vulnerability."}, {"lang": "es", "value": "Los SDK de Dart y Flutter proporcionan kits de desarrollo de software para el lenguaje de programaci\u00f3n Dart. En versiones del SDK de Dart anteriores a la 3.11.0 y del SDK de Flutter anteriores a la versi\u00f3n 3.41.0, cuando el cliente pub ('dart pub' y 'flutter pub') extrae un paquete en la cach\u00e9 de pub, un archivo de paquete malicioso puede tener archivos extra\u00eddos fuera del directorio de destino en el `PUB_CACHE`. Se ha implementado una correcci\u00f3n en el commit 26c6985c742593d081f8b58450f463a584a4203a. Al normalizar la ruta del archivo antes de escribir el archivo, el atacante ya no puede ascender a trav\u00e9s de un enlace simb\u00f3lico. Este parche se publica en Dart 3.11.0 y Flutter 3.41.0. Todos los paquetes en pub.dev han sido examinados para esta vulnerabilidad. Ya no se permite que los nuevos paquetes contengan enlaces simb\u00f3licos. El propio cliente pub no sube enlaces simb\u00f3licos, sino que duplica la entrada enlazada, y ha estado haciendo esto durante a\u00f1os. Aquellos cuyas dependencias provienen todas de pub.dev, repositorios de terceros de confianza para no contener c\u00f3digo malicioso, o dependencias de git no se ven afectados por esta vulnerabilidad."}], "lastModified": "2026-03-13T00:56:42.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dart:dart_software_development_kit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6068B05-8EC9-45A7-A97B-4071F121A443", "versionEndExcluding": "3.11.0"}, {"criteria": "cpe:2.3:a:flutter:flutter:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7244D310-C064-4E17-B0BA-B3FC800333C9", "versionEndExcluding": "3.41.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}