{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asquaresquash/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:square:squash:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-109391"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Square Squash (\u003c= e73f280)"],"_cs_severities":["high"],"_cs_tags":["deserialization","remote-code-execution","cve-2026-109391"],"_cs_type":"advisory","_cs_vendors":["Square"],"content_html":"\u003cp\u003eSquare Squash, a tool often used for symbolication, contains an insecure deserialization vulnerability identified as CVE-2026-109391. The vulnerability exists in all versions through commit e73f280. It specifically affects the /api/1.0/symbolication endpoint, where an unauthenticated attacker can submit a crafted YAML payload. When the application later attempts to symbolicate occurrences that reference the attacker-provided symbolication UUID, the stored malicious YAML data is passed to the Ruby YAML.load method configured in an unsafe mode. This execution flow leads to arbitrary Ruby object deserialization, which can be leveraged to achieve remote code execution on the underlying host. Given the nature of this vulnerability, immediate remediation is required for any internet-facing instances of the affected software.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthenticated remote code execution, granting an attacker full control over the affected Squash instance. This could lead to sensitive data theft, further lateral movement within the network, or persistent compromise of the development or symbolication infrastructure. The severity is marked as high with a CVSS v3.1 base score of 8.1.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Square Squash to a commit later than e73f280 or apply the vendor-provided patch immediately.\u003c/li\u003e\n\u003cli\u003eImplement strict ingress filtering for the /api/1.0/symbolication endpoint to prevent unauthenticated access.\u003c/li\u003e\n\u003cli\u003eAudit logs for unexpected POST requests to the symbolication API endpoint originating from untrusted network segments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:33:37Z","date_published":"2026-10-12T18:33:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-109391/","summary":"Square Squash through commit e73f280 is vulnerable to insecure deserialization via the /api/1.0/symbolication endpoint, allowing unauthenticated attackers to achieve arbitrary Ruby object deserialization and potential remote code execution.","title":"Insecure Deserialization in Square Squash","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-109391/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:square:squash:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}