CVE-2022-2421 Information

Description

Due to improper type validation in attachment parsing the Socket.io js library it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.

Reference

https://csirt.divd.nl/cves/CVE-2022-2421 https://csirt.divd.nl/cases/DIVD-2022-00045