Description
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Remediation
References
https://csirt.divd.nl/DIVD-2022-00045
https://csirt.divd.nl/CVE-2022-2421
Related Vulnerabilities
CVE-2023-24163 Vulnerability in maven package cn.hutool:hutool-all
CVE-2018-20676 Vulnerability in maven package org.webjars.bower:bootstrap
CVE-2020-35214 Vulnerability in maven package io.atomix:atomix
CVE-2017-16119 Vulnerability in npm package fresh
CVE-2022-36911 Vulnerability in maven package org.jenkins-ci.plugins:openstack-heat