Description
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Remediation
References
https://csirt.divd.nl/CVE-2022-2421
https://csirt.divd.nl/DIVD-2022-00045
Related Vulnerabilities
CVE-2019-10306 Vulnerability in maven package org.jenkins-ci.plugins:ontrack
CVE-2017-2646 Vulnerability in maven package org.keycloak:keycloak-saml-core
CVE-2022-43183 Vulnerability in maven package com.xuxueli:xxl-job
CVE-2017-16129 Vulnerability in maven package org.webjars.npm:superagent
CVE-2020-13128 Vulnerability in maven package com.googlecode.gwtupload:gwtupload