CVE-2026-109391 | Square Squash YAML YAML.load deserialization

October 12, 2026 Yanac

A vulnerability was found in Square Squash. It has been declared as critical. This affects the function YAML.load of the component YAML Handler. Executing a manipulation can lead to deserialization. This vulnerability only affects products that are no longer supported by the maintainer.

This vulnerability appears as CVE-2026-109391. The attack may be performed from remote. There is no available exploit.

Applying a patch is advised to resolve this issue.VulDB Recent EntriesRead More