Search
Find a vulnerability
Search criteria
2 vulnerabilities found for Squash by Square
CVE-2026-109391 (GCVE-0-2026-109391)
Vulnerability from nvd – Published: 2026-10-12 15:16 – Updated: 2026-10-13 16:57 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API
Summary
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 16:40 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJ87QX5ifg | technical-descriptionexploit |
| https://github.com/SquareSquash/web/blob/e73f2805… | technical-description |
| https://github.com/SquareSquash/web/blob/e73f2805… | technical-description |
| https://github.com/SquareSquash/web/blob/e73f2805… | technical-description |
| https://github.com/SquareSquash/web/blob/e73f2805… | technical-description |
| https://github.com/SquareSquash/web | product |
| https://www.vulncheck.com/advisories/square-squas… | third-party-advisory |
Impacted products
Date Public
2026-10-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109391",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T16:40:50.798651Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:57:23.986Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/SquareSquash/web",
"product": "Squash",
"repo": "https://github.com/SquareSquash/web",
"vendor": "Square",
"versions": [
{
"lessThanOrEqual": "e73f2805f9eb30780a5c213b001f0f4255660fbf",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T15:16:39.257Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJ87QX5ifg"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/app/controllers/api/v1_controller.rb"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/config/preinitializers/safe_yaml.rb"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/lib/workers/symbolication_creator.rb"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/app/models/symbolication.rb"
},
{
"tags": [
"product"
],
"url": "https://github.com/SquareSquash/web"
},
{
"name": "VulnCheck Advisory: Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/square-squash-through-commit-e73f280-unauthenticated-yaml-deserialization-via-symbolication-api"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109391",
"datePublished": "2026-10-12T15:16:39.257Z",
"dateReserved": "2026-10-12T14:40:37.988Z",
"dateUpdated": "2026-10-13T16:57:23.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109391 (GCVE-0-2026-109391)
Vulnerability from cvelistv5 – Published: 2026-10-12 15:16 – Updated: 2026-10-13 16:57 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API
Summary
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 16:40 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJ87QX5ifg | technical-descriptionexploit |
| https://github.com/SquareSquash/web/blob/e73f2805… | technical-description |
| https://github.com/SquareSquash/web/blob/e73f2805… | technical-description |
| https://github.com/SquareSquash/web/blob/e73f2805… | technical-description |
| https://github.com/SquareSquash/web/blob/e73f2805… | technical-description |
| https://github.com/SquareSquash/web | product |
| https://www.vulncheck.com/advisories/square-squas… | third-party-advisory |
Impacted products
Date Public
2026-10-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109391",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T16:40:50.798651Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:57:23.986Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/SquareSquash/web",
"product": "Squash",
"repo": "https://github.com/SquareSquash/web",
"vendor": "Square",
"versions": [
{
"lessThanOrEqual": "e73f2805f9eb30780a5c213b001f0f4255660fbf",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T15:16:39.257Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJ87QX5ifg"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/app/controllers/api/v1_controller.rb"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/config/preinitializers/safe_yaml.rb"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/lib/workers/symbolication_creator.rb"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660fbf/app/models/symbolication.rb"
},
{
"tags": [
"product"
],
"url": "https://github.com/SquareSquash/web"
},
{
"name": "VulnCheck Advisory: Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/square-squash-through-commit-e73f280-unauthenticated-yaml-deserialization-via-symbolication-api"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109391",
"datePublished": "2026-10-12T15:16:39.257Z",
"dateReserved": "2026-10-12T14:40:37.988Z",
"dateUpdated": "2026-10-13T16:57:23.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}