From http://www.squidguard.org/

Available patches for version 1.4:
[...]
Patch-20150201: Fixes a XSS vulnerability in the blocking script squidGuard.cgi See the Readme file for details about applying the patch. 

http://www.squidguard.org/Downloads/CHANGELOG
2015-02-01	Fixed a cross site vulnerability in squidGuard.cgi

From the README in the archive:

###############################################################################                                                  
#                                                                             #
#               Patch 20150201 for squidGuard version 1.3 and 1.4             #
#                                                                             #
###############################################################################


Introduction:
=============

This patch fixes a reflected cross site scripting vulnerability in the blocking
script squidGuard.cgi. The vulnerability is triggered when a user clicks a link
to a blocked site where the url has scripting instructions added. 


Mitigation:
===========
The problem only occurs if the %u paramter is used when calling squidGuard.cgi.
Users with static block pages or those who do not use this parameter will not
face this problem.

===

From glancing at the diff, the relevant change seems to include at lease:

> +$url =~ s/</&lt;/g ;
> +$url =~ s/>/&gt;/g ;
> +
>  status("403 Forbidden");

I do not see this issue referenced or applied in our packages. Also no CVE assignment apparent.