CVE-2020-8923

An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject custom html/javascript (XSS). Mitigation: update your Dart SDK to 2.7.2, and 2.8.0-dev.17.0 for the dev version. If you cannot update, we recommend you review the way you use the affected APIs, and pay special attention to cases where user-provided data is used to populate DOM nodes. Consider using Element.innerText or Node.text to populate DOM elements.

• CWE-79
• CWE-79

• https://github.com/dart-lang/sdk/security/advisories/GHSA-hfq3-v9pv-p627Third Party Advisory
• https://github.com/dart-lang/sdk/security/advisories/GHSA-hfq3-v9pv-p627Third Party Advisory

Published

Mar 26, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8912A vulnerability in the in-band key negotiation exists in the…2.5
• CVE-2020-8913A local, arbitrary code execution vulnerability exists in th…8.8
• CVE-2020-8916A memory leak in Openthread's wpantund versions up to commit…5.5
• CVE-2020-8918An improperly initialized 'migrationAuth' value in Google's …7.1
• CVE-2020-8919An information leak vulnerability exists in Gerrit versions …3.5
• CVE-2020-8920An information leak vulnerability exists in Gerrit versions …3.5
• CVE-2020-8927A buffer overflow exists in the Brotli library versions prio…6.5
• CVE-2020-8929A mis-handling of invalid unicode characters in the Java imp…5.3
• CVE-2020-8933A vulnerability in Google Cloud Platform's guest-oslogin ver…7.8
• CVE-2020-8934The Site Kit by Google plugin for WordPress is vulnerable to…4.3
• CVE-2020-8935An arbitrary memory overwrite vulnerability in Asylo version…7.8
• CVE-2020-8936An arbitrary memory overwrite vulnerability in Asylo version…5.5