CVE-2020-24807

The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code…

published October 6, 2020

CVSS
—
EPSS
2%
Percentile
81.5
In the wild
Unconfirmed
What it is

The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02096 · 81.5th percentile
Published
2020-10-06T17:10Z
EPSS history
Timeline
  • 06 OCT 17:10Z
    The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code…
    cvelistv5