JVN#29902403: Installers generated by Squirrel.Windows may insecurely load Dynamic Link Libraries

Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications.
Installers generated by Squirrel.Windows contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries (CWE-427).

Impact

Arbitrary code may be executed with the privilege of the user invoking the installer.

Solution

As of December 21, 2022, the fixed version is not provided.
According to the developer, there are no plans to release the fixed version soon, but the following fix was committed to ‘develop’ branch of the GitHub repository on June 1, 2021.

• Better delay load urlmon and move official build to GH Actions #1807
  You should create Squirrel.Windows from the latest source code from ‘develop’ branch and use it to generate an installer.

Products Affected

• Installers generated by Squirrel.Windows 2.0.1 and earlier