Description
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Remediation
References
https://csirt.divd.nl/DIVD-2022-00045
https://csirt.divd.nl/CVE-2022-2421
Related Vulnerabilities
CVE-2017-5664 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2019-10313 Vulnerability in maven package org.jenkins-ci.plugins:twitter
CVE-2022-21192 Vulnerability in npm package serve-lite
CVE-2020-10727 Vulnerability in maven package org.apache.activemq:artemis-core-client
CVE-2016-10735 Vulnerability in maven package org.webjars.bowergithub.jasny:bootstrap