PatchTheCVECVE-2026-27704: The Dart and Flutter SDKs provide software development kits for the Dart programming language
CVE-2026-27704 is a high-severity flaw (CVSS 7.5) affecting dart software development kit, flutter. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Dart and Flutter SDKs provide software development kits for the Dart programming language. In versions of the Dart SDK prior to 3.11.0 and the Flutter SDK prior to version 3.41.0, when the pub client (`dart pub` and `flutter pub`) extracts a package in the pub cache, a malicious package archive can have files extracted outside the destination directory in the `PUB_CACHE`. A fix has been landed in commit 26c6985c742593d081f8b58450f463a584a420
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 65%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2026-02-25 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-27704?
dart software development kit: upgrade to 3.11.0; flutter: upgrade to 3.41.0. Exact commands for each OS are on this page.
Is CVE-2026-27704 being exploited?
CVE-2026-27704 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-27704 affect?
CVE-2026-27704 affects dart software development kit, flutter. Severity is high (CVSS 7.5). The Dart and Flutter SDKs provide software development kits for the Dart programming language. In versions of the Dart SDK prior to 3.11.0 and the Flutter SDK prior to version 3.41.0, when the pub client (`dart pub` and `flutter pub`) extra
How urgent is CVE-2026-27704?
Priority 40/100. High severity; Remotely exploitable, no login, no user action