Description
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Remediation
References
https://csirt.divd.nl/CVE-2022-2421
https://csirt.divd.nl/DIVD-2022-00045
Related Vulnerabilities
CVE-2022-39236 Vulnerability in npm package matrix-js-sdk
CVE-2016-5388 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2013-1965 Vulnerability in maven package org.apache.struts:struts-core
CVE-2018-15890 Vulnerability in maven package org.ethereum:ethereumj-core
CVE-2015-8860 Vulnerability in maven package org.webjars:tar