External risk intelligence

Square Squash YAML Deserialization Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-109391

The vulnerability exists in an API endpoint (POST /api/1.0/symbolication) designed for handling data processing. APIs of this nature, especially those involving symbolication or similar backend services in web applications, are commonly exposed as public-facing or edge services to facilitate integration, making them plausibly reachable from the internet in standard deployment patterns.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Square Squash application allows unauthenticated attackers to execute arbitrary code by sending specially crafted data to an API endpoint. This occurs because the application improperly processes YAML data, which can lead to the deserialization of malicious objects and potential system compromise. The main concern is confirming whether this specific application is in use and exposed to such an attack.

Attackers can run any code on the system.
This affects applications processing symbolication data.
Assess relevance and exposure of the application.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could send a crafted YAML payload to a specific API endpoint. This payload would be stored and later processed by a vulnerable deserialization function when referenced. If the application processes this stored data, it could lead to arbitrary code execution.

Unauthenticated access to API endpoint.
Stored YAML processed by insecure deserialization.
Potential for arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the system. This is possible by sending a crafted YAML payload to the symbolication API, which is then deserialized unsafely. This could occur when the system processes symbolication requests that reference attacker-controlled data.

Arbitrary code execution is at risk.
Unauthenticated crafted YAML can be stored.
Full system compromise is a possibility.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability likely impacts application owners and platform teams responsible for the Square Squash web application. The first practical step is to identify all instances of the affected technology, confirm their reachability and business criticality, and then assign ownership for remediation planning.

Application owners should own the issue.
Verify external reachability and business criticality.
Plan coordinated remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Square Squash?

Square Squash is a web application used for processing symbolication data, which helps translate machine-level code addresses into human-readable source code information. It often serves as a backend utility or service within development pipelines to handle debugging data.

What does deserialization vulnerability mean in CVE-2026-109391?

This is a CWE-502 weakness. It occurs when an application takes data from an untrusted source—in this case, YAML input—and converts it back into complex programming objects. If the application does not properly validate this data, an attacker can craft malicious objects that force the system to perform unintended actions, such as executing arbitrary code.

How is this vulnerability triggered?

An attacker must send a malicious YAML payload to the POST /api/1.0/symbolication endpoint. The bug is not triggered by the initial storage of the data, but rather later when the application processes the stored information during a symbolication request using an unsafe configuration.

Why should I care if my instance is internet-facing?

Halo Surface Signal indicates that the affected API is often deployed as a public-facing or edge service to facilitate integrations. Because the flaw allows unauthenticated access, any instance reachable from the internet poses a significant risk of compromise, as attackers do not need prior system access to initiate the attack.

What should I do first to address this?

Begin by auditing your infrastructure to locate all active instances of Square Squash. Once identified, evaluate whether these instances are accessible from the internet and determine their overall business importance. This information will help you prioritize the remediation planning process with the appropriate team owners.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.