Is injection of node.js code realistic?

Question

Node.js

Is it possible to inject malicious code into a socket.io send?
There is such a code on the node.js side that receives an event

socket.on('make_turn', function(data) { //выполнение хода
    var gid = data.gid,
    acts = data.acts;
      	makeTurn(gid, acts);
  });

Is it possible to somehow tweak data and execute malicious code?