Critical Deserialization Flaw in Square Squash Allows Remote Code Execution
An unauthenticated attacker can trigger arbitrary Ruby code execution in Square Squash by storing crafted YAML data via a public API endpoint.
Key points
- CVE-2026-109391 is rated CVSS 9.2 Critical by the National Vulnerability Database.
- The flaw exists in Square Squash versions up to commit e73f2805f9eb30780a5c213b001f0f4255660fbf.
- Attackers exploit the POST /api/1.0/symbolication endpoint to store malicious YAML payloads.
The National Vulnerability Database has published CVE-2026-109391, a critical vulnerability in Square Squash that enables arbitrary code execution. The flaw allows unauthenticated attackers to deserialize malicious Ruby objects by abusing a specific API endpoint.
At a glance
- CVE
- CVE-2026-109391
- Product
- Square Squash
- CVSS
- 9.2 Critical
- Weakness
- insecure deserialization
- Exploited
- No known exploitation
According to the NVD record, the vulnerability carries a CVSS score of 9.2, categorizing it as Critical. The underlying weakness is identified as CWE-502, which relates to insecure deserialization. The source material rates the severity as Critical based on this score.
Context and Background
The vulnerability resides in the symbolication feature of Square Squash. An attacker can send a POST request to the /api/1.0/symbolication endpoint to store crafted YAML data. This action does not require authentication, making the endpoint accessible to anyone on the internet.
When the application later processes occurrences that reference the attacker-controlled symbolication UUID, it retrieves the stored YAML values. The system then passes these values to the YAML.load function with SafeYAML set to unsafe mode. This configuration allows the deserialization of arbitrary Ruby objects, leading to potential remote code execution.
Who Is Affected
Square Squash versions up to commit e73f2805f9eb30780a5c213b001f0f4255660fbf are affected by this issue. Organizations running these versions are exposed to the risk of unauthenticated remote code execution.
The NVD record does not mention a specific release date for the vulnerability disclosure or a confirmed patch. Users should verify their current version against the affected commit hash to determine if they are vulnerable.
What should you do?
Security teams should immediately audit their Square Squash installations to check for the presence of the vulnerable commit. If the software is exposed to the internet, the risk of exploitation is significantly higher due to the lack of authentication requirements.
Background: Insecure deserialization
Look for base64-encoded parameters, unexpected object instantiation, or state changes that bypass authentication. Inspect input handling for unvalidated deserialization. Use allowlists for expected data types and verify integrity with digital signatures to prevent arbitrary code execution.
Read the full guide: Warning Signs of Insecure Deserialization in Web Applications
What to do and how to stay safe: Square Squash
- Identify all instances of Square Squash in your environment and verify their version against the affected commit hash.
- Restrict access to the /api/1.0/symbolication endpoint using network-level controls or web application firewalls to prevent unauthenticated access.
- Monitor server logs for unusual POST requests to the symbolication endpoint or unexpected Ruby object instantiation events.
- Wait for an official update from the vendor before applying any unofficial patches, as no fix has been confirmed yet.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-109391?
The National Vulnerability Database rates CVE-2026-109391 as 9.2, which is categorized as Critical.
Does exploiting this vulnerability require authentication?
No, the vulnerability allows unauthenticated attackers to store crafted YAML data via the API endpoint.
Which versions of Square Squash are affected?
Square Squash versions up to commit e73f2805f9eb30780a5c213b001f0f4255660fbf are affected.
