The Dart and Flutter SDK’s pub client extracts packages into the user’s PUB_CACHE directory. In SDK versions earlier than Dart 3.11.0 and Flutter 3.41.0, the extraction routine did not normalize the file path of items inside a package archive. A malicious package could therefore include a symlink that points to a location outside the intended cache, allowing the pub client to create or overwrite arbitrary files on the host filesystem. This represents a classic path‑traversal flaw (CWE‑22). The vulnerability was addressed in commit 26c6985c742593d081f8b58450f463a584a4203a, where path normalization is performed before writing files, and new packages are prevented from containing symlinks. Consequently, only the older SDK releases remain affected.

Affected are Dart SDK prior to version 3.11.0 and Flutter SDK prior to version 3.41.0. These are distributed by dart‑lang and flutter. Packages on pub.dev that include symlinks trigger the flaw; any dependencies that are exclusively from pub.dev, trusted third‑party repositories that do not ship malicious code, or git repositories do not trigger the vulnerability.

CVSS 6.6 denotes medium severity. EPSS below 1 % indicates very low likelihood of exploitation, and the issue is not listed in CISA’s KEV catalog. Exploitation requires the attacker to deliver a malicious package archive, typically by controlling a package on pub.dev or a git repository trusted by the user. Successful exploitation results in local file overwrite, which could compromise build artifacts or introduce malicious code into the codebase.