CVE-2024-48915

Agent Dart is an agent library built for Internet Computer for Dart and Flutter apps. Prior to version 1.0.0-dev.29, certificate verification in `lib/agent/certificate.dart` does not occur properly. During the delegation verification in the `_checkDelegation` function, the canister_ranges aren't verified. The impact of not checking the canister_ranges is that a subnet can sign canister responses in behalf of another subnet. The certificate’s timestamp, i.e /time path, is also not verified, meaning that the certificate effectively has no expiration time. Version 1.0.0-dev.29 implements appropriate certificate verification.

• CWE-295

• https://github.com/AstroxNetwork/agent_dart/blob/f50971dfae3f536c1720f0084f28afbcf5d99cb5/lib/agent/certificate.dart#L162
• https://github.com/AstroxNetwork/agent_dart/blob/main/lib/agent/certificate.dart
• https://github.com/AstroxNetwork/agent_dart/commit/0d200686aabcd9313c7bc3e675cbdc82f6b775cf
• https://github.com/AstroxNetwork/agent_dart/security/advisories/GHSA-fmj7-7gfw-64pg

Published

Oct 15, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-4891The Essential Blocks – Page Builder Gutenberg Blocks, Patter…5.4
• CVE-2024-48910DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanit…9.8
• CVE-2024-48911OpenCanary, a multi-protocol network honeypot, directly exec…7.8
• CVE-2024-48912GLPI is a free asset and IT management software package. Sta…8.1
• CVE-2024-48913Hono, a web framework, prior to version 4.6.5 is vulnerable …5.9
• CVE-2024-48914Vendure is an open-source headless commerce platform. Prior …9.1
• CVE-2024-48916Ceph is a distributed object, block, and file storage platfo…8.1
• CVE-2024-48917PhpSpreadsheet is a PHP library for reading and writing spre…7.5
• CVE-2024-48918RDS Light is a simplified version of the Reflective Dialogue…8.1
• CVE-2024-48919Cursor is a code editor built for programming with AI. Prior…9.2
• CVE-2024-4892The BuddyPress plugin for WordPress is vulnerable to Stored …5.4
• CVE-2024-48920PutongOJ is online judging software. Prior to version 2.1.0-…9.1