Threats affecting pkg:github/albertodemichelis/squirrel

A security flaw has been discovered in Squirrel up to 3.2. Impacted is the function ReadObject of the file squirrel/sqobject.cpp of the component Cnut File Handler. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-8261 is a heap-based buffer overflow vulnerability in the Squirrel scripting language up to version 3.2. It specifically affects the SQFunctionProto::Load function in the squirrel/sqobject.cpp source file. The vulnerability allows local attackers to cause memory corruption. The issue has been publicly disclosed, but no official patch or remediation has been released by the project as of the publication date. Exploitation requires local access and no privileges or user interaction are needed. The vulnerability has a medium severity rating with a CVSS score of 5.1.

CVE-2026-8258 is a medium severity stack-based buffer overflow vulnerability in the Squirrel scripting language up to version 3.2. The flaw exists in the validate_format function within the sqstdlib/sqstdstring.cpp library. Exploitation requires local access and can lead to memory corruption. Although an exploit has been published, there is no official vendor response or patch available yet. The vulnerability was responsibly disclosed but remains unaddressed as of the publication date.

A vulnerability was determined in Squirrel up to 3.2. This vulnerability affects the function sqstd_rex_newnode in the library sqstdlib/sqstdrex.cpp. Executing a manipulation can lead to null pointer dereference. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in Squirrel up to 3.2. This affects the function SQCompiler::Factor/SQCompiler::UnaryOP of the file squirrel/sqcompiler.cpp. Performing a manipulation results in uncontrolled recursion. The attack needs to be approached locally. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.