Description
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Remediation
References
https://csirt.divd.nl/CVE-2022-2421
https://csirt.divd.nl/DIVD-2022-00045
Related Vulnerabilities
CVE-2021-21294 Vulnerability in maven package org.http4s:http4s-blaze-server_2.13
CVE-2019-13234 Vulnerability in maven package org.opencms:opencms-core
CVE-2019-20503 Vulnerability in npm package electron
CVE-2020-14326 Vulnerability in maven package org.jboss.resteasy:resteasy-core
CVE-2016-15025 Vulnerability in npm package generator-hottowel