PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-109391 Square CVE debrief

CVE-2026-109391: Square Squash through commit e73f280 contains a critical unauthenticated YAML deserialization vulnerability via the Symbolication API, potentially leading to code execution. This vulnerability allows attackers to store crafted YAML, which can be deserialized when occurrences referencing the attacker-controlled symbolication UUID are symbolicated, enabling arbitrary Ruby object deserialization. Defenders should prioritize remediation and verify affected versions to address potential code execution risks.

Vendor
Square
Product
Squash
CVSS
CRITICAL 9.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders responsible for Square Squash deployments should assess exposure and prioritize remediation. This vulnerability can lead to potential code execution, making it critical to address.

Why it matters

CVE-2026-109391 is a critical vulnerability in Square Squash that allows unauthenticated YAML deserialization via the Symbolication API, potentially leading to code execution. Defenders should prioritize remediation and verify affected versions.

  • Potential code execution through arbitrary Ruby object deserialization.
  • Unauthenticated attackers can store crafted YAML via the Symbolication API.
  • Verification of affected versions and remediation is necessary.
  • Monitoring for suspicious activity related to the Symbolication API is recommended.

Technical summary

The vulnerability exists in Square Squash through commit e73f280, where an unauthenticated attacker can store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.

Defensive priority

High

Recommended defensive actions

  • Review and update Squash deployments to ensure they are not using affected versions.
  • Implement additional security measures to restrict access to the /api/1.0/symbolication endpoint.
  • Monitor for suspicious activity related to the Symbolication API.
  • Verify the integrity of stored YAML data and implement input validation.
  • Conduct regular security audits to identify potential vulnerabilities.
  • Develop an incident response plan in case of potential code execution.
  • Document and track remediation efforts for auditing purposes.

Evidence notes

The CVE record and source item provide details on the insecure deserialization vulnerability in Square Squash through commit e73f280. The vulnerability allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint, which can lead to arbitrary Ruby object deserialization and potential code execution when occurrences referencing the attacker-controlled symbolication UUID are symbolicated.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-109391 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-109391

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-109391 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-109391

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109391.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJ87QX5ifg

    Supplemental source - technical-description, exploit

  • Source reference

    Unverified legacy reference

    URL: https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/app/controllers/api/v1_controller.rb

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/config/preinitializers/safe_yaml.rb

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/lib/workers/symbolication_creator.rb

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/app/models/symbolication.rb

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/SquareSquash/web

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/square-squash-through-commit-e73f280-unauthenticated-yaml-deserialization-via-symbolication-api

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.