Square Squash contains an insecure deserialization flaw that allows unauthenticated callers to submit crafted YAML data via the /api/1.0/symbolication endpoint. The server stores this data and later loads it with YAML.load in unsafe mode, enabling the execution of arbitrary Ruby objects and potentially allowing attackers to execute code on the host system. The impact is therefore that a remote attacker could gain code execution privileges on the Squash server.

The vulnerable product is Square Squash, as identified by the Square CNA vendor. The flaw exists in the code base up to and including commit e73f280, affecting any deployed versions that incorporate that commit or earlier. No other version ranges are specified in the CNA data.

The CVSS score of 9.2 indicates a critical severity. The vulnerability is exploitable without authentication, requiring only a crafted POST request to the symbolication API. Although an EPSS score is not available, the high CVSS and lack of remediation listed in the KeV catalog suggest a high risk of exploitation. Successful exploitation would lead to remote code execution with the privileges of the Squash application.