CVE-2026-109391: Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.
Affected Software
Event History
Frequently Asked Questions
What must happen after the malicious YAML is submitted for exploitation to reach deserialization?
An occurrence must reference the attacker-controlled symbolication UUID and then be symbolicated. During that process, the stored values are passed to YAML.load with SafeYAML configured in unsafe mode.
Does exploitation require authentication or user interaction?
No. The affected POST /api/1.0/symbolication endpoint can be used by unauthenticated attackers, and the supplied vector indicates no user interaction is required.
What is the potential impact if exploitation succeeds?
The unsafe YAML deserialization can enable arbitrary Ruby object deserialization and potential code execution. The reported impact includes high confidentiality, integrity, and availability effects.