Description
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Remediation
References
https://csirt.divd.nl/CVE-2022-2421
https://csirt.divd.nl/DIVD-2022-00045
Related Vulnerabilities
CVE-2015-1832 Vulnerability in maven package org.apache.derby:derby
CVE-2016-2402 Vulnerability in maven package com.squareup.okhttp:okhttp
CVE-2017-7556 Vulnerability in maven package io.hawt:project
CVE-2016-4800 Vulnerability in maven package org.eclipse.jetty:jetty-util
CVE-2014-3600 Vulnerability in maven package org.apache.activemq:activemq-core