Description
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Remediation
References
https://csirt.divd.nl/CVE-2022-2421
https://csirt.divd.nl/DIVD-2022-00045
Related Vulnerabilities
CVE-2022-34114 Vulnerability in maven package io.dataease:dataease-plugin-common
CVE-2017-16114 Vulnerability in maven package org.webjars.npm:marked
CVE-2022-37262 Vulnerability in npm package steal
CVE-2014-3120 Vulnerability in maven package org.elasticsearch:elasticsearch
CVE-2023-36479 Vulnerability in maven package org.eclipse.jetty.ee9:jetty-ee9-servlets