Nixpkgs security tracker

Untriaged

Permalink CVE-2026-3388

3.3 LOW

CVSS version: 3.1
Attack vector (AV):
Attack complexity (AC):
Privileges required (PR):
User interaction (UI):
Scope (S):
Confidentiality impact (C):
Integrity impact (I):
Availability impact (A):

created 1 month, 3 weeks ago Activity log

Created suggestion 1 month, 3 weeks ago

Squirrel sqcompiler.cpp UnaryOP recursion

A vulnerability was found in Squirrel up to 3.2. This affects the function SQCompiler::Factor/SQCompiler::UnaryOP of the file squirrel/sqcompiler.cpp. Performing a manipulation results in uncontrolled recursion. The attack needs to be approached locally. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

References

VDB-348274 | Squirrel sqcompiler.cpp UnaryOP recursion vdb-entrytechnical-description
VDB-348274 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
Submit #761314 | albertodemichelis squirrel master-branch Uncontrolled Recursion third-party-advisory
https://github.com/albertodemichelis/squirrel/issues/312 issue-tracking
https://github.com/oneafter/0122/blob/main/i312/repro exploit

Affected products

Squirrel

==3.1
==3.2
==3.0

Matching in nixpkgs

pkgs.squirrel-sql

Universal SQL Client

nixos-unstable 5.0.0
- nixpkgs-unstable 5.0.0
- nixos-unstable-small 5.0.0
nixos-25.11 5.0.0
- nixos-25.11-small 5.0.0
- nixpkgs-25.11-darwin 5.0.0

pkgs.squirreldisk

Cross-platform disk usage analysis tool

pkgs.vimPlugins.nvim-treesitter-parsers.squirrel

None

nixos-unstable 0.0.0+rev=072c969
- nixpkgs-unstable 0.0.0+rev=072c969
- nixos-unstable-small 0.0.0+rev=072c969
nixos-25.11 -
- nixos-25.11-small
- nixpkgs-25.11-darwin

Package maintainers

@peret Peter Retzlaff