Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Socket.io-parser | Socket | * | 4.0.5 (excluding) |
| Socket.io-parser | Socket | 4.1.0 (including) | 4.2.1 (excluding) |