CVE-2022-2421
EUVD-2022-715326.10.2022, 10:15
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| socket | socket.io-parser | 𝑥 < 3.3.3 |
| socket | socket.io-parser | 3.4.0 ≤ 𝑥 < 3.4.2 |
| socket | socket.io-parser | 4.0.0 ≤ 𝑥 < 4.0.5 |
| socket | socket.io-parser | 4.1.0 ≤ 𝑥 < 4.2.1 |
𝑥
= Vulnerable software versions