Log in Start free

Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109391Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API

High 8.1

In plain English

A high-severity unsafe deserialization in Squash from Square. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 58.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.

Affected products (as reported)

VendorProductVersions
Square Squash 0 – through e73f2805f9eb30780a5c213b001f0f4255660fbf

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References