Squash
Monthly
Unauthenticated remote code execution is achievable in Square Squash (all versions through commit e73f280) through a two-stage YAML deserialization path in the symbolication API. An attacker first stores crafted YAML under a chosen symbolication UUID using the unauthenticated POST /api/1.0/symbolication endpoint; the payload only detonates when occurrences referencing that UUID are later processed by the symbolication worker, at which point the stored value is passed to YAML.load with SafeYAML running in unsafe mode, permitting arbitrary Ruby object instantiation and code execution. Publicly available exploit code exists, and no CISA KEV listing confirms active exploitation; exploitation is deferred rather than immediate, which is why the assessed complexity is high (AC:H) despite requiring no authentication or user interaction.
Unauthenticated remote code execution is achievable in Square Squash (all versions through commit e73f280) through a two-stage YAML deserialization path in the symbolication API. An attacker first stores crafted YAML under a chosen symbolication UUID using the unauthenticated POST /api/1.0/symbolication endpoint; the payload only detonates when occurrences referencing that UUID are later processed by the symbolication worker, at which point the stored value is passed to YAML.load with SafeYAML running in unsafe mode, permitting arbitrary Ruby object instantiation and code execution. Publicly available exploit code exists, and no CISA KEV listing confirms active exploitation; exploitation is deferred rather than immediate, which is why the assessed complexity is high (AC:H) despite requiring no authentication or user interaction.