Square Squash CVE-2026-109391

Two concrete steps are required: (1) an attacker stores crafted YAML via the unauthenticated POST /api/1.0/symbolication endpoint under a chosen symbolication UUID, and (2) the deserialization only fires when occurrences referencing that attacker-controlled UUID are later symbolicated, at which point the stored value reaches YAML.load. The critical enabling configuration is SafeYAML operating in unsafe mode (per config/preinitializers/safe_yaml.rb), which permits arbitrary Ruby object deserialization. The principal limiting factor is this deferred trigger - exploitation is not instantaneous on request but depends on the symbolication worker processing referencing occurrences - matching the CVSS AC:H (high complexity) and AT:P (present attack requirement) metrics; no authentication or user interaction is required.

Multiple signals point to a genuinely high technical-impact flaw but a constrained real-world threat. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) confirms a network-reachable, unauthenticated entry point with full VC:H/VI:H/VA:H impact (CWE-502 deserialization leading to RCE), which rightly drives the 9.2 score. However, two deflating signals coexist: AC:H and AT:P indicate the attack is NOT turn-key - exploitation requires a specific precondition beyond merely sending the payload (the stored crafted YAML must subsequently be processed when occurrences referencing the attacker-controlled symbolication UUID are symbolicated). A public POC/exploit exists (VulnCheck advisory and a hackmd write-up), raising practical exploitability, but this is NOT the same as active exploitation: the CVE is not listed in CISA KEV and no EPSS score was provided in the input, so widespread opportunistic exploitation cannot be asserted. Net: this is a real, patch-worthy RCE for anyone running Square Squash, but the affected product is a niche, largely unmaintained open-source tool, so prioritization should be driven by whether the product is actually deployed rather than by the headline 9.2. Missing data to note explicitly: no EPSS and no KEV entry were supplied, and no fixed version is given (the advisory describes the state 'through commit e73f280'), so patch status could not be independently confirmed.

A remote, unauthenticated attacker sends a POST request to /api/1.0/symbolication containing a crafted YAML payload, which Squash stores under an attacker-chosen symbolication UUID. When the application later symbolicates occurrences that reference that UUID, the stored value is passed to YAML.load with SafeYAML running in unsafe mode, deserializing arbitrary Ruby objects and achieving code execution on the server. A public proof-of-concept exploit is available (VulnCheck/hackmd), but the attacker must wait for or induce the symbolication-processing step, consistent with the CVSS AC:H/AT:P rating.