CVE-2022-46330

ÉLEVÉE 7.8CVE-2022-46330 · Published 21/12/2022 · updated 17/06/2026

En bref

CVE-2022-46330 est une vulnérabilité ÉLEVÉE (CVSS 7.8) touchant squirrel.windows (squirrel.windows project).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.41%, plus élevée que 35.7% des vulnérabilités.
Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.

Package	Affected versions	Patched versions
squirrel.windows squirrel.windows_project	`≤ 2.0.1`	No fix yet

Description

Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows 2.0.1 and earlier contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.

References

Squirrel/Squirrel.Windows · Third Party Advisory
Squirrel/Squirrel.Windows#1807 · Patch
jvn.jp/en/jp/JVN29902403/index.html · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free