CVE-2026-109391
CRITICAL
9,2
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH
8,1
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
Description
AI Translation Available
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.
502
Deserialization of Untrusted Data
DraftCommon Consequences
Security Scopes Affected:
Integrity
Availability
Other
Potential Impacts:
Modify Application Data
Unexpected State
Dos: Resource Consumption (Cpu)
Varies By Context
Applicable Platforms
Languages:
Java, Ruby, PHP, Python, JavaScript
Technologies:
Not Technology-Specific, ICS/OT, AI/ML
https://github.com/SquareSquash/web
https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660f…
https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660f…
https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660f…
https://github.com/SquareSquash/web/blob/e73f2805f9eb30780a5c213b001f0f4255660f…
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HJ87QX5ifg
https://www.vulncheck.com/advisories/square-squash-through-commit-e73f280-unaut…