Description
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Remediation
References
https://csirt.divd.nl/CVE-2022-2421
https://csirt.divd.nl/DIVD-2022-00045
Related Vulnerabilities
CVE-2020-7640 Vulnerability in npm package pixl-class
CVE-2018-20834 Vulnerability in maven package org.webjars:tar
CVE-2019-25075 Vulnerability in maven package io.gravitee.management:gravitee-management-api-service
CVE-2023-49293 Vulnerability in npm package vite
CVE-2020-15366 Vulnerability in maven package org.webjars.bowergithub.epoberezkin:ajv