Description
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Remediation
References
https://csirt.divd.nl/CVE-2022-2421
https://csirt.divd.nl/DIVD-2022-00045
Related Vulnerabilities
CVE-2016-10606 Vulnerability in npm package grunt-webdriver-qunit
CVE-2015-9238 Vulnerability in npm package secure-compare
CVE-2018-18893 Vulnerability in maven package com.hubspot.jinjava:jinjava
CVE-2019-11002 Vulnerability in npm package materialize-css
CVE-2019-13990 Vulnerability in maven package org.quartz-scheduler.internal:quartz-core