CVE-2021-22568

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend upgrading past https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8 or beyond version 2.15.0

• CWE-255
• CWE-668

• https://github.com/dart-lang/sdk/blob/main/CHANGELOG.mdPatch, Third Party Advisory
• https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8Patch, Third Party Advisory
• https://github.com/dart-lang/sdk/security/advisories/GHSA-r32f-vhjp-qhj7Issue Tracking
• https://github.com/dart-lang/sdk/blob/main/CHANGELOG.mdPatch, Third Party Advisory
• https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8Patch, Third Party Advisory
• https://github.com/dart-lang/sdk/security/advisories/GHSA-r32f-vhjp-qhj7Issue Tracking

Published

Dec 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-2256Vulnerability in the Oracle Storage Cloud Software Appliance…10
• CVE-2021-22563Invalid JPEG XL images using libjxl can cause an out of boun…4.4
• CVE-2021-22564For certain valid JPEG XL images with a size slightly larger…5.5
• CVE-2021-22565An attacker could prematurely expire a verification code, ma…6.5
• CVE-2021-22566An incorrect setting of UXN bits within mmu_flags_to_s1_pte_…9.8
• CVE-2021-22567Bidirectional Unicode text can be interpreted and compiled d…3.5
• CVE-2021-22569An issue in protobuf-java allowed the interleaving of com.go…5.5
• CVE-2021-2257Vulnerability in the Oracle Storage Cloud Software Appliance…4.1
• CVE-2021-22570Nullptr dereference when a null char is present in a proto s…5.5
• CVE-2021-22571A local attacker could read files from some other users' SA3…5.5
• CVE-2021-22572On unix-like systems, the system temporary directory is shar…5.5
• CVE-2021-22573The vulnerability is that IDToken verifier does not verify i…7.3