CVE-2022-46330

HOCH 7.8CVE-2022-46330 · Published 21/12/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-46330 ist eine Schwachstelle (HOCH (CVSS 7.8)) in squirrel.windows (squirrel.windows project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.41%, höher als bei 35.7% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
squirrel.windows squirrel.windows_project	`≤ 2.0.1`	No fix yet

Description

Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows 2.0.1 and earlier contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.

References

Squirrel/Squirrel.Windows · Third Party Advisory
Squirrel/Squirrel.Windows#1807 · Patch
jvn.jp/en/jp/JVN29902403/index.html · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free