Where to report
The one public program Dart runs.
| Program | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|
Dart SDK
Sorona · Bug bounty |
$3,100 | Partial | – | – | Open |
-
- Safe harbor
- Partial
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
10 targets. 7 excluded.
-
https://dart.dev
Web
-
dart:ffi and the native interop layer, the boundary at which Dart hands pointers and struct layouts to code the VM does not control
Products and areas
-
Google's open-source VRP takes security issues in the latest versions of the code held in the repositories it lists, and the tier file names four Dart repositories at TIER_OT1: dart-lang/sdk plus the companions dart-lang/tools, dart-lang/test and dart-lang/build. A product vulnerability anywhere in those four is accepted, at $101 to $3,133.70
Products and areas
-
Repository configuration and the release pipelines behind the published SDK artefacts, which Google prices under its separate supply-chain category
Products and areas
-
The companion OT1 repositories: the shared packages in dart-lang/tools, the package:test runner and the build_runner code-generation stack, all of which execute on developer machines and in CI
Products and areas
-
The core libraries the language ships with, including dart:core, dart:async, dart:isolate, dart:typed_data, dart:convert and dart:io, together with the bounds and range checks the native implementation enforces underneath them
Products and areas
-
The Dart VM in full: the bytecode interpreter, the JIT and AOT compilers, the isolate model, the garbage collector, and the snapshot and kernel loaders a released binary runs on every launch
Products and areas
-
The front end and static tooling in the same repository: the parser, the common front end, the analyzer and the language server
Products and areas
-
The in-repo command-line tooling: dart, dart compile, dart test and the pub client, including package resolution and the archives it downloads and unpacks
Products and areas
-
The web compilation backends, dart2js and dart2wasm, and the JavaScript and WebAssembly interop the generated output relies on
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 7
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Any Google repository absent from the tier file, which sits at OT2 or OT3 and pays nothing for a product vulnerability
-
Awards to researchers on a sanctions list, in a territory subject to sanctions, or located in Russia or Belarus, which Google states it cannot pay
-
Defects that only reproduce on a release the project no longer ships, since the program covers the latest versions
-
Flutter itself (flutter/flutter), which Google rates OT0 and prices on its own entry rather than this one
-
Memory-corruption reports filed without exact OSS-Fuzz reproduction steps against an existing fuzz target, including how to build the image, or an already merged patch
-
Social engineering, and issues only exploitable by someone who already has maintainer or commit access
-
Third-party pub.dev packages that Google does not own, which fall outside the tier file entirely
Recent changes
Reward and scope changes across every Dart program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Dart products, from the NVD.
-
CVE-2026-27704 Medium
The Dart and Flutter SDKs provide software development kits for the Dart programming language. In versions of the Dart SDK prior to 3.11.0 and the Flutter SDK prior to version 3.41.0, when the pub client (`dart pub` and `flutter pub`) extracts a package in the pub cache, a malicious package archive can have files extracted outside the destination directory in the `PUB_CACHE`. A fix has been landed
-
CVE-2014-125098 Medium
A vulnerability was found in Dart http_server up to 0.9.5 and classified as problematic. Affected by this issue is the function VirtualDirectory of the file lib/src/virtual_directory.dart of the component Directory Listing Handler. The manipulation of the argument request.uri.path leads to cross site scripting. The attack may be launched remotely. Upgrading to version 0.9.6 is able to address this
-
CVE-2022-3095 Critical
The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue.
-
CVE-2022-0451 Medium
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive auth
-
CVE-2021-22567 Medium
Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a code review by appearing benign. An attacker could embed a source that is invisible to a code reviewer that modifies the behavior of a program in unexpected ways.
-
CVE-2021-22568 High
When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend upgrading past https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8 or beyond
-
CVE-2021-22540 Medium
Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags.
-
CVE-2020-35669 Medium
An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request.
About this page
This page gathers every public program listed under dart.dev: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.