NVD Rates Square Squash YAML Flaw Critical 9.2 CVSS Score for Unauthenticated RCE
Unauthenticated attackers can exploit CVE-2026-109391 to execute arbitrary Ruby code in Square Squash via crafted YAML input.
Key points
- National Vulnerability Database assigns CVE-2026-109391 a critical CVSS score of 9.2.
- The flaw involves insecure deserialization of YAML data through the symbolication endpoint.
- Square Squash versions up to commit e73f280 are affected by this vulnerability.
Square Squash contains a critical insecure deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code. The National Vulnerability Database rates CVE-2026-109391 as critical with a CVSS score of 9.2. This flaw enables remote code execution through the manipulation of symbolication data.
Root cause
The vulnerability stems from the handling of YAML data within the application. According to the NVD record, the system processes stored values using YAML.load with SafeYAML in unsafe mode. This configuration permits the deserialization of arbitrary Ruby objects. The weakness is classified under CWE-502, which covers insecure deserialization issues.
Attack path
Attackers can store crafted YAML content via the POST /api/1.0/symbolication endpoint. No authentication is required to perform this initial storage action. When the system later symbolises occurrences that reference the attacker-controlled symbolication UUID, it processes the stored values. This triggers the unsafe deserialization mechanism, leading to potential code execution on the host.
Affected versions
- Square Squash through commit e73f2805f9eb30780a5c213b001f0f4255660fbf is vulnerable.
- Versions prior to this specific commit are affected by CVE-2026-109391.
- The National Vulnerability Database lists these versions as containing the insecure deserialization flaw.
Mitigation
- No confirmed patch or fix has been announced by the vendor yet.
- Developers should restrict access to the symbolication endpoint if possible.
- Monitor for official advisories regarding CVE-2026-109391.
- Isolate vulnerable instances from untrusted networks.
Background: CVSS score
The Common Vulnerability Scoring System provides a standardised method to rank flaw severity. It enables teams to prioritise remediation efforts based on exploitability and impact. However, the score is a static snapshot that ignores your specific architecture. You must combine it with context-aware analysis to make accurate risk decisions.
Read the full guide: Why CVSS Scores Matter for Real-World Security Decisions
What to do and how to stay safe: Square Squash
- Audit your Square Squash deployment to identify the current commit version.
- Review access controls on the /api/1.0/symbolication endpoint to limit exposure.
- Monitor system logs for unusual deserialization activity or unexpected code execution.
- Wait for an official update from the vendor before applying any unverified fixes.
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-109391?
It is a critical insecure deserialization vulnerability in Square Squash that allows remote code execution.
How severe is this vulnerability?
The National Vulnerability Database rates it as critical with a CVSS score of 9.2.
Which versions are affected?
Square Squash versions up to and including commit e73f2805f9eb30780a5c213b001f0f4255660fbf are affected.
