Unauthenticated Code Execution Risk in Square Squash via Insecure Deserialization

Organizations using Square Squash for crash reporting face a severe security risk due to an insecure deserialization flaw. The National Vulnerability Database rates CVE-2026-109391 as Critical, assigning it a CVSS score of 9.2. This vulnerability allows unauthenticated attackers to store malicious data within the application without needing valid credentials.

How does the vulnerability function technically?

The issue stems from how Square Squash processes data submitted to its symbolication API. According to the NVD record, attackers can send crafted YAML payloads to the POST /api/1.0/symbolication endpoint. These payloads are stored within the system and linked to a specific symbolication UUID controlled by the attacker. This initial storage step does not immediately execute code but prepares the environment for exploitation.

When the application later processes occurrences that reference this attacker-controlled UUID, it retrieves the stored values. The system then passes these values to the YAML.load function. Crucially, this operation occurs with SafeYAML set to unsafe mode, which removes standard protections against arbitrary object creation during the loading process.

What are the potential consequences for affected systems?

The combination of insecure storage and unsafe processing enables arbitrary Ruby object deserialization. As described in the vulnerability details, this mechanism can lead to potential code execution on the server hosting Square Squash. Because the initial storage phase requires no authentication, attackers can prepare the exploit payload from outside the network perimeter.

The severity rating of 9.2 reflects the critical nature of the flaw as defined by the National Vulnerability Database. The source material identifies the weakness as CWE-502, indicating an insecure deserialization issue. The potential for code execution arises directly from the unsafe handling of YAML data during the symbolication process.

Which versions of Square Squash are affected?

The vulnerability impacts Square Squash instances running versions up to and including commit e73f2805f9eb30780a5c213b001f0f4255660fbf. The NVD record specifies this commit hash as the upper bound for affected software. Any deployment using a version prior to this specific commit is considered vulnerable to the insecure deserialization attack vector.

Users must verify their current installation against this commit identifier to determine exposure. There is no mention of a patched version or a fix in the provided source material. Consequently, organizations cannot rely on a simple update to resolve the issue based on the current information.

What defensive measures should IT teams implement?

Security teams should immediately audit their Square Squash installations to determine if they fall within the vulnerable range defined by the commit hash. Since no fix has been confirmed yet, the primary defense is containment and monitoring. Organizations should restrict network access to the /api/1.0/symbolication endpoint, limiting it to trusted internal IPs if possible.

Monitoring logs for unusual POST requests to this endpoint can help detect early exploitation attempts. Additionally, reviewing server logs for unexpected Ruby object creation or deserialization errors may indicate active abuse. Until a vendor patch is available, consider isolating affected instances from untrusted networks.

Background: National Vulnerability Database

The National Vulnerability Database lists known flaws but lacks deployment context. Do not treat every entry as an immediate emergency. Cross-reference findings with your asset inventory and usage patterns to determine real risk, rather than reacting to every new identifier.

Read the full guide: National Vulnerability Database: Five Common Misreadings and Fixes

What to do and how to stay safe: Square Squash

• Verify your Square Squash version against commit e73f2805f9eb30780a5c213b001f0f4255660fbf to confirm exposure.
• Restrict network access to the POST /api/1.0/symbolication endpoint to trusted internal addresses only.
• Monitor server logs for unusual activity related to YAML processing or deserialization errors.
• Isolate affected servers from untrusted networks until a vendor-provided update is available.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-109391?

The National Vulnerability Database assigns a CVSS score of 9.2, rating the severity as Critical.

Is authentication required to exploit this vulnerability?

No, the vulnerability allows unauthenticated attackers to store crafted YAML via the API endpoint.

Which specific commit marks the boundary for affected versions?

Square Squash versions up to commit e73f2805f9eb30780a5c213b001f0f4255660fbf are affected.