Insecure Deserialization in Square Squash Affects Unauthenticated Users
CVE-2026-109391

9.2CRITICAL

Key Information:

Vendor: Square
Status: Squash
Vendor: CVE Published:; 12 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-109391?

The vulnerability in Square Squash arises from an insecure deserialization mechanism, allowing unauthenticated users to manipulate the application. Specifically, the vulnerability exists within the '/api/1.0/symbolication' endpoint, where attackers can send crafted YAML data. This data, when linked with an attacker-controlled symbolication UUID, is processed with YAML.load using SafeYAML in an unsafe mode, permitting arbitrary Ruby object deserialization. Consequently, this may lead to potential code execution on the server, compromising the application's integrity and the data it handles.

Affected Version(s)

Squash 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-109391 - Proof of Concept