by Kastro
Paper/Archive/CVE-2026-109391

CVE-2026-109391

Square Squash — Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API

EPSS 0.5%CVSS 9.2
critical.is priorityof 100
36
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 41.1.411 × 208.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.

Affected

ProductAffectedFixed inSource
Squash≤ e73f2805f9eb30780a5c213b001f0f4255660fbf–CNA

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

exploithackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJ87QX5ifgwriteupgithub.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/app/controllers/api/v1_controller.rbwriteupgithub.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/config/preinitializers/safe_yaml.rbwriteupgithub.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/lib/workers/symbolication_creator.rbwriteupgithub.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/app/models/symbolication.rbrefgithub.com/SquareSquash/webwriteupvulncheck.com/advisories/square-squash-through-commit-e73f280-unauthenticated-yaml-deserialization-via-symbolication-api