Square Squash: Unauthenticated YAML deserialization in symbolication API

Summary

Square Squash through commit e73f280 contains an insecure deserialization flaw in its POST /api/1.0/symbolication endpoint. An unauthenticated attacker can store crafted YAML, which is later loaded with SafeYAML in unsafe mode when occurrences referencing the attacker-controlled UUID are symbolicated. Successful exploitation can lead to arbitrary Ruby object deserialization and potentially code execution on the server.

Affected

• Square Squash through commit e73f2805f9eb30780a5c213b001f0f4255660fbf (per CNA record: versions 0 to commit e73f280 are affected; default is unaffected)

Fixed in

Unknown. No vendor fix or patched release has been identified.

Workaround

• No vendor-published workaround.
• Restrict network access to /api/1.0/symbolication to trusted client hosts, for example via reverse proxy or firewall ACL. This is a general recommendation, not a vendor statement.

Exploitation

• No confirmed exploitation in the wild; no KEV listing identified in the reviewed sources.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• Public proof-of-concept status is unverified and sources conflict.

Our recommendation

• Inventory all Squash deployments, including version or commit and internet exposure.
• Block or restrict external and untrusted access to the Squash API now.
• Check the SquareSquash/web repository and the VulnCheck advisory for a fix or maintenance notice.
• If a deployed instance cannot be confirmed as patched, consider decommissioning it or replacing it with a maintained tool.
• Monitor exploit and KEV status and re-check in a few days.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Square Squash web repository github.com
• Vulnerable controller at commit e73f280 github.com
• SafeYAML configuration at commit e73f280 github.com
• Symbolication model at commit e73f280 github.com
• VulnCheck advisory www.vulncheck.com
• OSV entry for CVE-2026-109391 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:44.