WS-2020-0443 | Mend Vulnerability Database

Vulnerability DatabaseWS-2020-0443

WS-2020-0443

Published:May 20, 2026

Updated:May 20, 2026

In socket.io in versions 1.0.0 to 2.3.0 is vulnerable to Cross-Site Websocket Hijacking, it allows an attacker to bypass origin protection using special symbols include "`" and "$".

Affected Packages

socket.io (CDN_JS):

Affected version(s) >=1.0.0-pre <2.4.0

Fix Suggestion:

Update to version 2.4.0

dgenies (CONDA):

Affected version(s) >=1.2.0.1 <=1.5.0

Fix Suggestion:

Update to version no_fix

quarto (CONDA):

Affected version(s) =1.1.145 <1.2.335

Fix Suggestion:

Update to version 1.2.335

jsdom (CONDA):

Affected version(s) =11.0.0 <11.11.0

Fix Suggestion:

Update to version 11.11.0

socket.io (NPM):

Affected version(s) >=1.0.0-pre <2.4.0

Fix Suggestion:

Update to version 2.4.0

autodomain.modules.core (NUGET):

Affected version(s) >=4.1.0 <=4.1.1

Fix Suggestion:

Update to version no_fix

newplatform.flexberry.designer.embercache (NUGET):

Affected version(s) =3.7.0-beta09

Fix Suggestion:

Update to version no_fix

midiator.webclient (NUGET):

Affected version(s) >=1.0.98 <1.0.105

Fix Suggestion:

Update to version 1.0.105

karmanodemodules (NUGET):

Affected version(s) >=1.0.0 <=1.0.1

Fix Suggestion:

Update to version no_fix

sheeler.angulartemplate (NUGET):

Affected version(s) =0.0.1

Fix Suggestion:

Update to version no_fix

pwptemplatepusintek (NUGET):

Affected version(s) =0.0.1

Fix Suggestion:

Update to version no_fix

autodomain.modules.core.blazor (NUGET):

Affected version(s) >=4.1.202 <4.1.205

Fix Suggestion:

Update to version 4.1.205

simplefile123 (NUGET):

Affected version(s) =1.0.0

Fix Suggestion:

Update to version no_fix

nordron.angulartemplate (NUGET):

Affected version(s) =0.1.5 <0.1.6

Fix Suggestion:

Update to version 0.1.6

sheelersoft.angulartemplate (NUGET):

Affected version(s) >=0.0.1 <=0.0.2

Fix Suggestion:

Update to version no_fix

dotnetng.template (NUGET):

Affected version(s) >=1.0.0.1 <1.0.0.4

Fix Suggestion:

Update to version 1.0.0.4

apace (NUGET):

Affected version(s) >=1.0.4 <=6.1.0.4

Fix Suggestion:

Update to version no_fix

pwptemplatecms (NUGET):

Affected version(s) >=0.0.1 <=0.0.2

Fix Suggestion:

Update to version no_fix

pterodactyl/panel (PHP):

Affected version(s) >=dev-feature/console-scrolldown <dev-feature/react-admin

Fix Suggestion:

Update to version dev-feature/react-admin

scancode/portal-module (PHP):

Affected version(s) >=v1.0.7 <v1.0.12

Fix Suggestion:

Update to version v1.0.12

pterodactyl/panel (PHP):

Affected version(s) >=dev-replace-allocation-repository <dev-softwarenoob/remove-ga

Fix Suggestion:

Update to version dev-softwarenoob/remove-ga

touskar/php-socket-io-event-emitter (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

mahendraempyreal/emp-chat (PHP):

Affected version(s) >=1.0.1 <=1.0.9

Fix Suggestion:

Update to version no_fix

bobzhai/cbsms (PHP):

Affected version(s) >=dev-main <=1.0

Fix Suggestion:

Update to version no_fix

kriss/yii2-web-msg-sender (PHP):

Affected version(s) =v1.0 <v1.1

Fix Suggestion:

Update to version v1.1

oceancodex/wpsp (PHP):

Affected version(s) >=8.1.0 <8.1.1

Fix Suggestion:

Update to version 8.1.1

foodsharing/foodsharing (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

originalsystems/yii2-app-kernel (PHP):

Affected version(s) >=v0.2.7 <v1.0.2

Fix Suggestion:

Update to version v1.0.2

mmi/mmi-cms (PHP):

Affected version(s) >=2.2.9.1 <2.3.1

Fix Suggestion:

Update to version 2.3.1

tianfuunion/mark-resources (PHP):

Affected version(s) >=dev-master <=0.1

Fix Suggestion:

Update to version no_fix

pterodactyl/panel (PHP):

Affected version(s) >=dev-Softwarenoob/docker-readme <dev-dane/fiddle-with-new-tables

Fix Suggestion:

Update to version dev-dane/fiddle-with-new-tables

flexxia/flexprimeng (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/css/postcss/minimatch-3.1.2 <dev-dependabot/npm_and_yarn/css/postcss/browserslist-4.17.0

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/css/postcss/browserslist-4.17.0

sroehrl/neoan-php (PHP):

Affected version(s) =dev-master <v2.0.1-beta

Fix Suggestion:

Update to version v2.0.1-beta

bobzhai/fourbrother (PHP):

Affected version(s) >=dev-main <=v1.0.1

Fix Suggestion:

Update to version no_fix

novosga/novosga (PHP):

Affected version(s) =dev-dependabot/composer/symfony/cache-4.3.11 <dev-dependabot/composer/symfony/serializer-4.4.35

Fix Suggestion:

Update to version dev-dependabot/composer/symfony/serializer-4.4.35

yanev/laraadmin (PHP):

Affected version(s) >=dev-master <=2.0.2

Fix Suggestion:

Update to version no_fix

mpcmf/mpcmf-web-app (PHP):

Affected version(s) =dev-master <1.0.0.x-dev

Fix Suggestion:

Update to version 1.0.0.x-dev

chrisbraybrooke/laravel-ecommerce (PHP):

Affected version(s) =dev-dev <dev-form-field-key

Fix Suggestion:

Update to version dev-form-field-key

pterodactyl/panel (PHP):

Affected version(s) =dev-feature/issue-18 <dev-softwarenoob/docker-arm64

Fix Suggestion:

Update to version dev-softwarenoob/docker-arm64

grandchef/php-socket-io-event-emitter (PHP):

Affected version(s) >=dev-master <=1.0.2

Fix Suggestion:

Update to version no_fix

panda-coder/phpanda (PHP):

Affected version(s) =dev-master <dev-oldMaster

Fix Suggestion:

Update to version dev-oldMaster

novosga/novosga (PHP):

Affected version(s) =v3.0.x-dev <dev-dependabot/composer/twig/twig-3.14.0

Fix Suggestion:

Update to version dev-dependabot/composer/twig/twig-3.14.0

pterodactyl/panel (PHP):

Affected version(s) >=dev-matthewpi/composer-upgrade-1 <dev-fix/forgev2

Fix Suggestion:

Update to version dev-fix/forgev2

mpcmf/mpcmf-web-app (PHP):

Affected version(s) =dev-php7

Fix Suggestion:

Update to version no_fix

chrisbraybrooke/laravel-ecommerce (PHP):

Affected version(s) >=v0.0.17 <0.0.56

Fix Suggestion:

Update to version 0.0.56

scancode/portal-module (PHP):

Affected version(s) >=v0.0.1 <dev-dependabot/npm_and_yarn/Resources/assets/coreui/decode-uri-component-0.2.2

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/Resources/assets/coreui/decode-uri-component-0.2.2

pterodactyl/panel (PHP):

Affected version(s) =dev-dane/restore-backups <dev-dane/sanctum

Fix Suggestion:

Update to version dev-dane/sanctum

dwij/laraadmin (PHP):

Affected version(s) =dev-Unit-Testing-1 <1.0.1

Fix Suggestion:

Update to version 1.0.1

novosga/novosga (PHP):

Affected version(s) =dev-master <v0.5.1

Fix Suggestion:

Update to version v0.5.1

oceancodex/wpsp (PHP):

Affected version(s) >=8.0.0 <8.0.1

Fix Suggestion:

Update to version 8.0.1

yewei-cao/noodle (PHP):

Affected version(s) >=dev-dependabot/npm_and_yarn/path-parse-1.0.7 <dev-dependabot/npm_and_yarn/y18n-3.2.2

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/y18n-3.2.2

wangliang/laravel-admin (PHP):

Affected version(s) >=dev-master <=v1.4

Fix Suggestion:

Update to version no_fix

novosga/novosga (PHP):

Affected version(s) =v2.1.x-dev <v2.1.1

Fix Suggestion:

Update to version v2.1.1

pterodactyl/panel (PHP):

Affected version(s) =dev-master <dev-matthewpi/database-tls

Fix Suggestion:

Update to version dev-matthewpi/database-tls

novosga/novosga (PHP):

Affected version(s) =2.0.0-RC1 <v2.0.0-RC1

Fix Suggestion:

Update to version v2.0.0-RC1

pterodactyl/panel (PHP):

Affected version(s) >=v0.6.4 <dev-actions/tests-patch-1

Fix Suggestion:

Update to version dev-actions/tests-patch-1

johnrazeur/php-socket-io-event-emitter (PHP):

Affected version(s) >=dev-master <v1.0.0

Fix Suggestion:

Update to version v1.0.0

mahendraempyreal/emp-chat (PHP):

Affected version(s) >=dev-main <1.0.0

Fix Suggestion:

Update to version 1.0.0

dickyermawan/yii2-socketio (PHP):

Affected version(s) >=dev-master <=v1.0

Fix Suggestion:

Update to version no_fix

frankyframework/franky2 (PHP):

Affected version(s) =dev-main

Fix Suggestion:

Update to version no_fix

ksaitechnologies/yii2-app-kernel (PHP):

Affected version(s) =dev-dich <dev-master

Fix Suggestion:

Update to version dev-master

pterodactyl/panel (PHP):

Affected version(s) >=dev-dane/laravel-8 <dev-dane/laravel-9

Fix Suggestion:

Update to version dev-dane/laravel-9

yewei-cao/noodle (PHP):

Affected version(s) >=dev-master <v0.0.31

Fix Suggestion:

Update to version v0.0.31

pterodactyl/panel (PHP):

Affected version(s) >=dev-feature/root-admin-suspended <dev-fix/forge

Fix Suggestion:

Update to version dev-fix/forge

blenderdeluxe/chat (PHP):

Affected version(s) >=dev-master <=1.0.0

Fix Suggestion:

Update to version no_fix

sroehrl/neoan-php (PHP):

Affected version(s) =2.0.11

Fix Suggestion:

Update to version no_fix

originalsystems/yii2-app-template (PHP):

Affected version(s) =v0.1.1 <v0.2.4

Fix Suggestion:

Update to version v0.2.4

novosga/novosga (PHP):

Affected version(s) =dev-v2.0.7-fix-reset <v2.0.7

Fix Suggestion:

Update to version v2.0.7

originalsystems/yii2-app-kernel (PHP):

Affected version(s) =dev-dich <dev-master

Fix Suggestion:

Update to version dev-master

efecanaltay/hello-world (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

flexxia/flexprimeng (PHP):

Affected version(s) =dev-anguarJs-v7 <dev-dependabot/npm_and_yarn/css/postcss/y18n-3.2.2

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/css/postcss/y18n-3.2.2

pterodactyl/panel (PHP):

Affected version(s) =dev-fix-2094 <dev-issue/3535

Fix Suggestion:

Update to version dev-issue/3535

jagermesh/bright (PHP):

Affected version(s) >=v2.0.10 <v2.0.12

Fix Suggestion:

Update to version v2.0.12

flexxia/flexprimeng (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/css/postcss/minimist-1.2.8 <dev-dependabot/npm_and_yarn/css/postcss/ini-1.3.8

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/css/postcss/ini-1.3.8

oceancodex/wpsp (PHP):

Affected version(s) >=8.2.0 <8.2.1

Fix Suggestion:

Update to version 8.2.1

chrisbraybrooke/laravel-ecommerce (PHP):

Affected version(s) =0.0.1 <0.0.2

Fix Suggestion:

Update to version 0.0.2

xlabs/notifybundle (PHP):

Affected version(s) >=dev-master <=1.0.14

Fix Suggestion:

Update to version no_fix

scancode/portal-module (PHP):

Affected version(s) >=v1.0.0 <dev-dependabot/npm_and_yarn/Resources/assets/coreui/path-parse-1.0.7

Fix Suggestion:

Update to version dev-dependabot/npm_and_yarn/Resources/assets/coreui/path-parse-1.0.7

novosga/novosga (PHP):

Affected version(s) =v2.2.x-dev <dev-dependabot/composer/twig/twig-2.14.11

Fix Suggestion:

Update to version dev-dependabot/composer/twig/twig-2.14.11

pterodactyl/panel (PHP):

Affected version(s) >=dev-develop <dev-eggs/rust

Fix Suggestion:

Update to version dev-eggs/rust

anupsathya/umd_bootstrap_sass (PHP):

Affected version(s) >=v0.2.7 <=v0.2.14

Fix Suggestion:

Update to version no_fix

basic-builder/easybuilder-bundle (PHP):

Affected version(s) >=dev-master <v0.0.3

Fix Suggestion:

Update to version v0.0.3

novosga/novosga (PHP):

Affected version(s) =v2.0.x-dev <v2.0.1

Fix Suggestion:

Update to version v2.0.1

zhangjf108/php-framework-application (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

yewei-cao/noodle (PHP):

Affected version(s) >=dev-dependabot/npm_and_yarn/engine.io-and-browser-sync-and-socket.io-6.2.1 <dev-feature/admin

Fix Suggestion:

Update to version dev-feature/admin

s00d/redis-web (PHP):

Affected version(s) =0.1.0 <0.1.1

Fix Suggestion:

Update to version 0.1.1

oceancodex/wpsp (PHP):

Affected version(s) >=dev-main <7.4.0

Fix Suggestion:

Update to version 7.4.0

sombrerodepaja/franky-skeleton-application (PHP):

Affected version(s) >=dev-dependabot/npm_and_yarn/engine.io-and-browser-sync-6.2.1 <dev-dev

Fix Suggestion:

Update to version dev-dev

ksaitechnologies/yii2-app-kernel (PHP):

Affected version(s) >=v0.2.7 <v1.0.2

Fix Suggestion:

Update to version v1.0.2

narirock/marrs-catalog (PHP):

Affected version(s) >=dev-dev <=1

Fix Suggestion:

Update to version no_fix

chrisbraybrooke/laravel-ecommerce (PHP):

Affected version(s) >=0.0.4 <0.0.17

Fix Suggestion:

Update to version 0.0.17

yewei-cao/noodle (PHP):

Affected version(s) =dev-dependabot/npm_and_yarn/decode-uri-component-0.2.2 <v0.03

Fix Suggestion:

Update to version v0.03

ristorantino/aditions (PHP):

Affected version(s) =dev-master <dev-master-ko-js-update

Fix Suggestion:

Update to version dev-master-ko-js-update

socieboy/chat (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

mriso_dev/nodejschat (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

bobzhai/apps (PHP):

Affected version(s) >=dev-master <=1.0.0

Fix Suggestion:

Update to version no_fix

pusaka3/framework (PHP):

Affected version(s) >=dev-develop <=v3.0.1

Fix Suggestion:

Update to version no_fix

dgenies (PYTHON):

Affected version(s) >=1.2.0.1 <=1.5.0

Fix Suggestion:

Update to version no_fix

electrscash (RUST):

Affected version(s) =1.0.0 <1.1.1

Fix Suggestion:

Update to version 1.1.1

Related Resources (1)

https://github.com/socketio/socket.io/commit/f78a575f66ab693c3ea96ea88429ddb1a44c86c7

Do you need more information?

CVSS v4

Base Score:

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

PASSIVE

Vulnerable System Confidentiality

HIGH

Vulnerable System Integrity

HIGH

Vulnerable System Availability

NONE

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

AI app security

Mend AI

Application security

Mend AppSec

Dependency management

Mend Renovate

Expand coverage

Runtime and beyond

AI security

Code security

Supply chain security

Compliance & reporting

vs. AI security tools

vs. AppSec tools

Buyer’s guides

About Mend.io

Partners & people

Customers

Learn & explore

Guides

Developers hub