Critical severity10.0NVD Advisory· Published Jul 28, 2022· Updated Jun 17, 2026
CVE-2021-41556
CVE-2021-41556
Description
sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games that embed a Squirrel Engine.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
8<=2.2.5, <=3.1+ 1 more
- (no CPE)range: <=2.2.5, <=3.1
- cpe:2.3:a:squirrel-lang:squirrel:*:*:*:*:*:*:*:*range: <=2.2.5
- Squirrel/Squirreldescription
- osv-coords3 versionspkg:rpm/opensuse/squirrel&distro=openSUSE%20Tumbleweedpkg:rpm/suse/squirrel&distro=SUSE%20Package%20Hub%2015%20SP4pkg:rpm/opensuse/squirrel&distro=openSUSE%20Leap%2015.4
< 3.2-1.1+ 2 more
- (no CPE)range: < 3.2-1.1
- (no CPE)range: < 3.0.7-bp154.3.3.1
- (no CPE)range: < 3.0.7-bp154.3.3.1
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
6- github.com/albertodemichelis/squirrel/commit/23a0620658714b996d20da3d4dd1a0dcf9b0bd98nvdPatchThird Party Advisory
- blog.sonarsource.com/squirrel-vm-sandbox-escape/nvdExploitThird Party Advisory
- www.squirrel-lang.orgnvdThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BV7SJJ44AGAX4ILIVPREIXPJ2GOG3FKV/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3FQILX7UUEERSDPMZP3MKGTMY2E7ESU/nvd
- www.sonarsource.com/blog/squirrel-vm-sandbox-escape/nvd
News mentions
0No linked articles in our index yet.