Square Squash Users Face Critical RCE Risk as CVE-2026-109391 Enables Unauthenticated Code Execution
A critical vulnerability in Square Squash allows attackers to execute arbitrary code by exploiting insecure YAML processing in the symbolication API endpoint.
Key points
- CVE-2026-109391 is rated Critical with a CVSS score of 9.2 by the NVD.
- The flaw affects Square Squash versions up to commit e73f2805f9eb30780a5c213b001f0f4255660fbf.
- Attackers can trigger arbitrary Ruby object deserialization without authentication.
Organisations using Square Squash face a significant risk of remote code execution due to a critical deserialization vulnerability. The National Vulnerability Database has assigned CVE-2026-109391 a CVSS score of 9.2, classifying the issue as Critical. This flaw allows unauthenticated attackers to inject malicious data into the application via its public API, potentially leading to full system compromise.
How it unfolded
- The vulnerability exists in Square Squash versions up to and including commit e73f2805f9eb30780a5c213b001f0f4255660fbf.
- An attacker sends a crafted YAML payload to the POST /api/1.0/symbolication endpoint.
- When the system processes symbolication for the attacker-controlled UUID, it loads the stored YAML.
- The application uses YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization.
Who is affected
Users of Square Squash are at risk if their installation has not been updated beyond commit e73f2805f9eb30780a5c213b001f0f4255660fbf. The vulnerability is classified under CWE-502, which relates to deserialization of untrusted data. Because the initial injection point requires no authentication, any entity with network access to the API endpoint can potentially exploit this weakness. The impact allows for arbitrary code execution on the server hosting the application.
The fix
No official patch or update has been confirmed by the vendor at this time. Users should verify their current version against the affected commit hash e73f2805f9eb30780a5c213b001f0f4255660fbf. If the system is running an older version, it remains vulnerable to the described attack vector. Monitoring official channels for release notes is recommended until a remediation is available.
What to do and how to stay safe: Square Squash
- Restrict network access to the /api/1.0/symbolication endpoint to trusted internal networks only.
- Monitor server logs for unusual POST requests to the symbolication API from unknown sources.
- Ensure Ruby objects are not deserialized from untrusted YAML sources in custom integrations.
- Isolate affected instances until a vendor-provided update is available for testing.
Step-by-step guide: Patch Management: Eight Questions Answered for Stability
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-109391 as Critical with a CVSS score of 9.2.
Which versions of Square Squash are affected?
All versions up to and including commit e73f2805f9eb30780a5c213b001f0f4255660fbf are affected.
Does an attacker need credentials to exploit this?
No, the vulnerability allows unauthenticated attackers to store crafted YAML via the API endpoint.
