Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-109391: Square Squash allows remote code execution via Symbolication API
CVE-2026-109391 · published 3 days ago
Summary
The Square Squash service can be tricked into loading specially crafted data through its Symbolication endpoint, which could let an unauthenticated attacker run arbitrary code on the server. This happens because the system processes the data without proper safety checks. Apply the latest security update from Square and restrict access to the Symbolication API to trusted users only.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| square | squash | <= e73f2805f9eb30780a5c213b001f0f4255660fbf |
Original advisory text
Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJ87QX5ifg Exploit
- https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fb... Third Party Advisory
- https://github.com/SquareSquash/web Product
- https://www.vulncheck.com/advisories/square-squash-through-commit-e73f280-unauth... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-1093... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-109391 Vendor Advisory
- https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fb... Third Party Advisory
- https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fb... Third Party Advisory
- https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fb... Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published12 Oct 2026
Updated15 Oct 2026
First seen12 Oct 2026
Track software like this
Free during beta