Squash vulnerabilities

1 known vulnerability in Squash from Square. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Squash: Deserialization of Untrusted Data

  CVE-2026-109391Oct 12, 2026Square

  Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication