Description
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Remediation
References
https://csirt.divd.nl/CVE-2022-2421
https://csirt.divd.nl/DIVD-2022-00045
Related Vulnerabilities
CVE-2022-21680 Vulnerability in npm package marked
CVE-2022-36907 Vulnerability in maven package org.jenkins-ci.plugins:openshift-deployer
CVE-2019-5447 Vulnerability in npm package http-file-server
CVE-2019-18212 Vulnerability in maven package org.lsp4xml:org.eclipse.lsp4xml.extensions.emmet
CVE-2022-24613 Vulnerability in maven package com.drewnoakes:metadata-extractor