Insecure Deserialization in Square Squash

Square Squash, a tool often used for symbolication, contains an insecure deserialization vulnerability identified as CVE-2026-109391. The vulnerability exists in all versions through commit e73f280. It specifically affects the /api/1.0/symbolication endpoint, where an unauthenticated attacker can submit a crafted YAML payload. When the application later attempts to symbolicate occurrences that reference the attacker-provided symbolication UUID, the stored malicious YAML data is passed to the Ruby YAML.load method configured in an unsafe mode. This execution flow leads to arbitrary Ruby object deserialization, which can be leveraged to achieve remote code execution on the underlying host. Given the nature of this vulnerability, immediate remediation is required for any internet-facing instances of the affected software.

Impact

Successful exploitation allows for unauthenticated remote code execution, granting an attacker full control over the affected Squash instance. This could lead to sensitive data theft, further lateral movement within the network, or persistent compromise of the development or symbolication infrastructure. The severity is marked as high with a CVSS v3.1 base score of 8.1.

Recommendation

• Upgrade Square Squash to a commit later than e73f280 or apply the vendor-provided patch immediately.
• Implement strict ingress filtering for the /api/1.0/symbolication endpoint to prevent unauthenticated access.
• Audit logs for unexpected POST requests to the symbolication API endpoint originating from untrusted network segments.