Key points
- CVE-2026-109391 allows unauthenticated remote code execution via insecure deserialization.
- The flaw affects Square Squash versions up to commit e73f2805f9eb30780a5c213b001f0f4255660fbf.
- NVD rates the vulnerability as Critical with a 9.2 CVSS score due to low complexity.
Square Squash contains a critical security flaw that permits unauthenticated attackers to execute arbitrary code on the server. The issue, tracked as CVE-2026-109391, stems from insecure deserialization within the application’s API. The National Vulnerability Database assigns a CVSS score of 9.2, indicating severe risk. Attackers can exploit this weakness without needing valid credentials or prior access to the system.
In plain English
The vulnerability exists in how Square Squash processes data sent to its symbolication endpoint. An attacker sends a specially crafted YAML file to the POST /api/1.0/symbolication URL. The system stores this data without sufficient validation. Later, when the application attempts to symbolize occurrences linked to the attacker’s UUID, it processes the stored content. This processing step triggers the dangerous behavior that leads to code execution.
The background
According to the NVD record, the root cause is the use of YAML.load with SafeYAML in unsafe mode. This configuration allows the deserialization of arbitrary Ruby objects rather than just safe data types. The flaw is present in all versions of Square Squash up to and including commit e73f2805f9eb30780a5c213b001f0f4255660fbf. The weakness is classified under CWE-502, which covers insecure deserialization. No specific vendor patch or update has been confirmed in the source material.
What changes now
Organizations using affected versions of Square Squash face immediate risk from unauthenticated remote code execution. Because the attack requires no credentials, any instance exposed to the internet is a potential target. Security teams must verify their current version against the affected commit hash. Until the vendor provides an update, the only mitigation is to restrict network access to the vulnerable endpoint or disable the service entirely.
Background: Unauthenticated remote code execution
Unauthenticated remote code execution often stems from default credentials, exposed management interfaces, and improper input handling. Fix these by enforcing strict authentication, disabling unused services, validating all inputs, and isolating privileged components from public networks.
Read the full guide: Unauthenticated RCE Mistakes: 7 Errors That Expose Your Systems
What to do and how to stay safe: Square Squash
- Verify if your Square Squash installation is at or before commit e73f2805f9eb30780a5c213b001f0f4255660fbf.
- Block external traffic to the POST /api/1.0/symbolication endpoint using firewall rules or WAF policies.
- Monitor logs for unusual POST requests to the API that might indicate exploitation attempts.
- Contact your vendor for guidance on temporary patches or workarounds until an official update is released.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-109391?
The NVD rates the vulnerability as Critical with a CVSS score of 9.2.
Does the attack require authentication?
No, the vulnerability allows unauthenticated attackers to store crafted YAML and trigger code execution.
Which versions of Square Squash are affected?
All versions through commit e73f2805f9eb30780a5c213b001f0f4255660fbf are affected by this insecure deserialization flaw.
