CVE-2026-109391

waiting for further signals

EUVD-2026-97489 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Square Squash

CWE-502 Deserialization of Untrusted Data

ETK-2026-1376, permanent identifier

cvss9.2cna vendorCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8d 12h 08msince last run

1h 50mAI analysis

timeline

0 = cve.org publication

trigger signal (cve.org) +0hwaiting for further signals+2h22m

+4h

+6h

+8h

+10h

+12h

description

Square Squash revisions through commit e73f280 can process attacker-supplied symbolication data using an unsafe YAML deserialization path. An unauthenticated attacker may be able to cause arbitrary Ruby object deserialization and potentially execute code when the submitted data is later symbolicated.

mitigation

Restrict access to the symbolication submission endpoint to trusted, authenticated clients and block untrusted symbolication data from being processed. No fixed version is recorded; monitor for an upstream update and apply it when available.

check

exploit

automation

–

auth required

EPSS

0.48%39th percentile

agent run time

1h 50m

cve.org record, t = 0

2026-10-12 15:16Z

Δ to public poc

–

Δ to kev

–

outcome

No artifact: an exploit or check was attempted but could not be produced at this moment.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-12 15:16Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-109391

this entry in the feed

GET /api/v1/feed/CVE-2026-109391

{
  "etk_id": "ETK-2026-1376",
  "cve_id": "CVE-2026-109391",
  "display_id": "CVE-2026-109391",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-97489",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe YAML deserialization in Square Squash",
  "summary": "Square Squash revisions through commit e73f280 can process attacker-supplied symbolication data using an unsafe YAML deserialization path. An unauthenticated attacker may be able to cause arbitrary Ruby object deserialization and potentially execute code when the submitted data is later symbolicated.",
  "mitigation": "Restrict access to the symbolication submission endpoint to trusted, authenticated clients and block untrusted symbolication data from being processed. No fixed version is recorded; monitor for an upstream update and apply it when available.",
  "vendor": "Square",
  "product": "Squash",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= e73f2805f9eb30780a5c213b001f0f4255660fbf"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Squash",
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 9.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0048,
  "epss_percentile": 0.3991,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 109.76210153333334,
  "t0_at": "2026-10-12T15:16:39.257000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-12T15:16:39.257000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T15:16:39.257000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109391"
    }
  }
}

published 2026-10-12 15:48Z
last change 2026-10-21 05:31Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.