CVE-2026-109391
Received Received - Intake

Insecure Deserialization in Square Squash via YAML.load

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109391
EUVD
EUVD-2026-97489

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Square Squash 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109391 is an unauthenticated unsafe YAML deserialization vulnerability in Square Squash's symbolication API. Attackers can upload malicious YAML payloads to the POST /api/1.0/symbolication endpoint without authentication. These payloads are stored and later processed by YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential remote code execution.

Detection Guidance

Check for unauthorized POST requests to /api/1.0/symbolication without authentication. Inspect logs for YAML payloads in symbols or lines parameters. Verify if SafeYAML is configured in unsafe mode by examining safe_yaml.rb.

Impact Analysis

This vulnerability allows unauthenticated attackers to execute arbitrary code on the server by exploiting unsafe YAML deserialization. It could lead to complete system compromise, data theft, or disruption of services if a suitable Ruby gadget chain exists. The attack requires knowledge of a valid UUID, which may be obtained from public client artifacts.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data processed by Square Squash. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A breach via this flaw may violate compliance requirements for data confidentiality and integrity.

Mitigation Strategies

Require API key authentication for symbolication uploads. Replace YAML.load with YAML.safe_load and enable strict type validation. Update SafeYAML configuration to use safe mode by default.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109391. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart