CVE-2026-109391
Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API
Square Squash
CVSS
9.2CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.48%Chance of exploitation activity in the next 30 days, higher than 40% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.
Text from CVE List
Affected versions 1
- Squashaffected: all versions through e73f2805f9eb30780a5c213b001f0f4255660fbfCVE List
References 7
- vulncheck.com/advisories/square-squash-through-commit-e73f280-unauthenticated-yaml-deserialization-via-symbolication-apiAdvisoryvia CVE List
- hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJ87QX5ifgExploitvia CVE List
- github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/app/controllers/api/v1_controller.rbReferencevia CVE List
- github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/config/preinitializers/safe_yaml.rbReferencevia CVE List
- github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/lib/workers/symbolication_creator.rbReferencevia CVE List
- github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/app/models/symbolication.rbReferencevia CVE List
- github.com/SquareSquash/webReferencevia CVE List