CVE-2020-24807: Socket.io-File Project Socket.io-File

High severity, CVSS 7.8. EPSS: 2.1% chance of exploitation in the next 30 days.

The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Affected products

• Socket.io-File Project Socket.io-File: up to and including 2.0.31

Published 2020-10-06. Last modified 2026-06-17.