---
id: CVE-2026-109391
title: >-
  Square Squash through commit e73f280 contains an insecure deserialization
  vulnerability that allows unauthenticated attackers to store crafted YAML via
  the POST /api/1.0/symbolication endpoint
summary: >-
  Square Squash through commit e73f280 contains an insecure deserialization
  vulnerability that allows unauthenticated attackers to store crafted YAML via
  the POST /api/1.0/symbolication endpoint. When occurrences referencing the
  attacker-c…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-502
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T16:17:04.373'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109391'
references:
  - url: 'https://github.com/SquareSquash/web'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/app/controllers/api/v1_controller.rb
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/app/models/symbolication.rb
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/config/preinitializers/safe_yaml.rb
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/lib/workers/symbolication_creator.rb
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJ87QX5ifg'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/square-squash-through-commit-e73f280-unauthenticated-yaml-deserialization-via-symbolication-api
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T16:57:59.912Z'
---

## Overview

Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.