10

CVE-2022-2421: socket socket.io-parser SQL Injection

CVSS: 10.0v3.1CriticalAnalyzed
AliasesGHSA-qm95-pgcg-qqfq
Published 25-10-2022Last modified 11-03-2025
Open JSON

Vulnerability summary

CVE-2022-2421 is a critical (CVSS 10.0) SQL Injection vulnerability in socket socket.io-parser. EPSS estimates a 1.27% chance of exploitation in the next 30 days, higher than 69.3% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.1 (CVE.org)
EPSS score
1.27%
0%100%
Low · +0.05 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 25-10-2022
    PublishedVulnerability first disclosed.
  2. 11-03-2025
    Last modifiedVulnerability information updated.

Description

Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

1.27%

Chance of exploitation in the next 30 days

Percentile

69%

Versus all other CVEs

30-day change

+0.05 pp

From 1.22% on 20-09-2026

20-09-202620-10-2026
EPSS score
1.27%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Npm1 product
  • socket.io-parser≥ 4.0.0, < 4.0.5 | ≥ 4.1.0, < 4.2.1 | < 3.3.3 | ≥ 3.4.0, < 3.4.2
Socket1 product
  • socket.io-parser< 3.3.3 | ≥ 3.4.0, < 3.4.2 | ≥ 4.0.0, < 4.0.5 | ≥ 4.1.0, < 4.2.1
Socketio1 product

3 vendors · 3 products

References

10 links