Cloudanix VulnDB

CVE-2021-41556

Critical · 10.0

CVSS

10.0

EPSS

2.8%

Published

Jul 28, 2022

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A scripting engine used by some apps and games can be tricked by a specially made script into letting attackers run their own code on the computer.

Exploit Available
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Remote Code Execution
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in sqclass.cpp of the Squirrel interpreter core that permits escape from the script sandbox and arbitrary code execution when an attacker-supplied script is run, even with dangerous functions disabled.

Why it matters to the business

Compromise of host systems in cloud customization platforms or embedded game engines that accept untrusted Squirrel scripts, enabling malware deployment or full environment takeover.

How an attack unfolds

An attacker supplies a crafted Squirrel script to a victim application; upon execution the script triggers the out-of-bounds read in the interpreter, breaks sandbox restrictions, and achieves native code execution on the host.

How to fix it

Upgrade albertodemichelis/squirrel to commit 23a0620658714b996d20da3d4dd1a0dcf9b0bd98; for Debian libxslt packages apply the 1.1.19-2 update or later. Disable untrusted script execution until patched.

How to confirm the fix worked

Confirm installed Squirrel version or commit hash matches the fixed revision; run known-triggering test scripts in a sandbox to verify absence of sandbox escape; retest after upgrade.

Typical attack path

  1. Identify application or service accepting attacker-controlled Squirrel scripts
  2. Craft script that triggers the out-of-bounds read in sqclass.cpp
  3. Deliver script via allowed customization or game asset channel
  4. Trigger script execution to escape sandbox and run native payloads

How to detect it

Review application logs for execution of unexpected Squirrel scripts; monitor for unusual process spawns or sandbox-violation indicators immediately after script execution; examine crash dumps or interpreter faults referencing sqclass.cpp.

What your security team should do

  • Apply the listed fixed versions immediately given public exploit availability
  • Inventory all products embedding Squirrel and prioritize those reachable from untrusted input
  • Temporarily disable or sandbox Squirrel script execution where upgrades cannot be applied quickly
  • Add script execution logging and monitoring for anomalous interpreter behavior

The record

sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games that embed a Squirrel Engine.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 squirrel3 0 No fix
Debian:13 squirrel3 0 No fix
Mageia:8 squirrel 0 3.2-1.mga8
Mageia:8 supertux 0 0.6.2-4.2.mga8
SUSE:Package Hub 15 SP4 squirrel 0 3.0.7-bp154.3.3.1
Ubuntu:18.04:LTS squirrel3 0 No fix
Ubuntu:20.04:LTS squirrel3 0 No fix
Ubuntu:22.04:LTS squirrel3 0 No fix
Ubuntu:24.10 squirrel3 0 No fix
Ubuntu:25.04 squirrel3 0 No fix
Ubuntu:25.10 squirrel3 0 No fix
Ubuntu:Pro:18.04:LTS squirrel3 0 No fix
Ubuntu:Pro:20.04:LTS squirrel3 0 No fix
openSUSE:Leap 15.4 squirrel 0 3.0.7-bp154.3.3.1
openSUSE:Tumbleweed squirrel 0 3.2-1.1

Related vulnerabilities