Description
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Remediation
References
https://csirt.divd.nl/CVE-2022-2421
https://csirt.divd.nl/DIVD-2022-00045
Related Vulnerabilities
CVE-2018-10469 Vulnerability in maven package org.b3log:symphony
CVE-2019-16335 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2020-8125 Vulnerability in npm package klona
CVE-2019-10407 Vulnerability in maven package hudson.plugins:project-inheritance
CVE-2023-37945 Vulnerability in maven package io.jenkins.plugins:miniorange-saml-sp