Description
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Remediation
References
https://csirt.divd.nl/CVE-2022-2421
https://csirt.divd.nl/DIVD-2022-00045
Related Vulnerabilities
CVE-2023-33510 Vulnerability in maven package org.jeecgframework.p3:jeecg-p3-biz-chat
CVE-2016-10549 Vulnerability in npm package sails
CVE-2023-26487 Vulnerability in maven package org.webjars.bowergithub.vega:vega
CVE-2021-46704 Vulnerability in npm package genieacs
CVE-2022-43418 Vulnerability in maven package org.jenkins-ci.plugins:katalon