Description
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Remediation
References
https://csirt.divd.nl/CVE-2022-2421
https://csirt.divd.nl/DIVD-2022-00045
Related Vulnerabilities
CVE-2016-8745 Vulnerability in maven package org.apache.tomcat:tomcat-util
CVE-2020-5245 Vulnerability in maven package io.dropwizard:dropwizard-validation
CVE-2021-43785 Vulnerability in npm package @joeattardi/emoji-button
CVE-2022-31189 Vulnerability in maven package org.dspace:dspace-jspui
CVE-2021-21615 Vulnerability in maven package org.jenkins-ci.main:jenkins-core