CVE-2026-109391
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.
Risk Assessment
The risk is remote code execution by an unauthenticated attacker, potentially leading to full server compromise and data breach.
Recommendation
Upgrade Square Squash to a patched version and avoid deserializing untrusted YAML data in unsafe mode.
Other vulnerabilities in Square Squash
Original NVD description (English source)
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS