CVE-2026-109391 Details

A vulnerability allowing insecure deserialization of YAML has been identified in Square Squash, specifically in the web application through commit e73f280. This issue arises in the symbolication API endpoint, where unauthenticated attackers can upload crafted YAML. The vulnerability is rooted in the SafeYAML configuration, which is set to unsafe by default, allowing for arbitrary Ruby object deserialization. When the deserialized data is processed, it could lead to potential code execution.

To address this vulnerability, it is recommended to require and validate an API key for symbolication uploads, authenticate the UUID against its associated project, and replace 'YAML.load' with 'YAML.safe_load' using a minimal allowlist of types. Additionally, the global SafeYAML setting should not be enabled to allow unsafe deserialization, and size, compression, and parsing limits should be enforced before data is processed by workers. After these changes, any symbolication records that may have been compromised should be rotated.