Description
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Remediation
References
https://csirt.divd.nl/CVE-2022-2421
https://csirt.divd.nl/DIVD-2022-00045
Related Vulnerabilities
CVE-2011-4367 Vulnerability in maven package org.apache.myfaces.core:myfaces-impl
CVE-2021-41182 Vulnerability in maven package org.webjars.npm:jquery-ui
CVE-2020-7760 Vulnerability in maven package org.webjars.npm:codemirror
CVE-2020-28452 Vulnerability in maven package com.softwaremill.akka-http-session:core_2.11
CVE-2016-0762 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core