{"id":"CVE-2022-2421","published":"2022-10-25T00:00:00Z","modified":"2025-03-11T13:40:55Z","title":"Socket.io - Improper type validation in attachment parsing","vendor":"Socket.io","product":"Socket.io-Parser","tier":"tail","description":{"text":"Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.","provenance":"source","from":"CVE.org"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01578,"percentile":0.75455,"provenance":"source"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://csirt.divd.nl/CVE-2022-2421","tags":["third-party-advisory"]},{"url":"https://csirt.divd.nl/DIVD-2022-00045","tags":["third-party-advisory"]}],"priority":{"score":22.1,"factors":[{"name":"EPSS percentile","points":15.09},{"name":"CVSS severity","points":7.0}]},"vendorSlug":"socket-io","affectedVersions":[{"vendor":"Socket.io","product":"Socket.io-Parser","versions":[">= 4.x, < 4.2.1"]}],"affected":[{"ecosystem":"npm","package":"socket.io-parser","vulnerableRanges":[">=4.0.0, <4.0.5",">=4.1.0, <4.2.1","<3.3.3",">=3.4.0, <3.4.2"],"patched":["4.0.5","4.2.1","3.3.3","3.4.2"],"from":["GHSA-qm95-pgcg-qqfq"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7153","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-socket-io-parser-cve-2020-36049","parents":[{"from":"CVE-2020-36049","to":"CVE-2022-2421","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:socket.io-parser","fromFixed":"3.3.2","toFixed":"3.3.3","daysApart":656},{"kind":"same-code","provenance":"machine","files":["index.js"],"commits":["https://github.com/socketio/socket.io-parser/commit/dcb942d24db97162ad16a67c2a0cf30875342d55","https://github.com/socketio/socket.io-parser/commit/04d23cecafe1b859fb03e0cbf6ba3b74dff56d14","https://github.com/socketio/socket.io-parser/commit/b559f050ee02bd90bd853b9823f8de7fa94a80d4"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2022-2421","to":"CVE-2023-32695","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:socket.io-parser","fromFixed":"4.2.1","toFixed":"4.2.3","daysApart":214},{"kind":"version-step","provenance":"source","package":"npm:socket.io-parser","fromFixed":"3.4.2","toFixed":"3.4.3","daysApart":214},{"kind":"same-code","provenance":"machine","files":["index.js","lib/index.ts"],"commits":["https://github.com/socketio/socket.io-parser/commit/04d23cecafe1b859fb03e0cbf6ba3b74dff56d14","https://github.com/socketio/socket.io-parser/commit/b559f050ee02bd90bd853b9823f8de7fa94a80d4","https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced","https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3"],"basis":"shared function","functions":["Decoder"]}]}],"packageHistory":[{"cve":"CVE-2020-36049","published":"2021-01-07","fixed":"3.4.1","kev":false},{"cve":"CVE-2022-2421","published":"2022-10-25","fixed":"4.2.1","kev":false},{"cve":"CVE-2023-32695","published":"2023-05-27","fixed":"4.2.3","kev":false},{"cve":"CVE-2026-33151","published":"2026-03-20","fixed":"4.2.6","kev":false},{"cve":"CVE-2026-69185","published":"2026-08-03","fixed":"4.2.7","kev":false}],"package":"npm:socket.io-parser"}}