Get the latest tech news
Three mistakes from Dart/Flutter's weak PRNG
A look into how an unexpectedly weak PRNG in Dart led to Zellic's discovery of multiple vulnerabilities
Once they have created their first project and are staring at their blank template, they might be tempted to look up the documentation online not knowing they are one click away from malicious users stealing files from their computer, or potentially executing code. At this point, the website can list directory contents, extract and exfiltrate secret files from the workspace, or overwrite build scripts and GIT hooks to indirectly run arbitrary code. After recovering the second secret and changing the workspace roots, the same can be applied to all files that the current user has access to, for example in a typical stealer malware fashion.
Or read this on Hacker News
