{"id":"CVE-2026-109391","title":"Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint","summary":"Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-c…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-502"],"published":"2026-10-12","updated":"2026-10-12","sourceUpdated":"2026-10-12T16:17:04.373","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-109391","references":[{"url":"https://github.com/SquareSquash/web","label":"disclosure@vulncheck.com"},{"url":"https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/app/controllers/api/v1_controller.rb","label":"disclosure@vulncheck.com"},{"url":"https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/app/models/symbolication.rb","label":"disclosure@vulncheck.com"},{"url":"https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/config/preinitializers/safe_yaml.rb","label":"disclosure@vulncheck.com"},{"url":"https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/lib/workers/symbolication_creator.rb","label":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJ87QX5ifg","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/square-squash-through-commit-e73f280-unauthenticated-yaml-deserialization-via-symbolication-api","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"ingestedAt":"2026-10-12T16:57:59.912Z","slug":"CVE-2026-109391","body":"## Overview\n\nSquare Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}