A security issue has been found in Dart before version 2.15.0. When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev.
A security issue has been found in Dart before version 2.15.0. When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth4 access_token that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev.
https://github.com/dart-lang/sdk/security/advisories/GHSA-r32f-vhjp-qhj7 https://github.com/dart-lang/pub/pull/3007 https://github.com/dart-lang/pub/commit/bbdac802eb27ab8aa2af6732f739e0b51561d718#diff-5fea24e813d36f3b0e47536ee2c1d5779d54bfd0991e693577b7e8a9fd7f141cR145-R183 https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8
Vulmon