CVE-2013-5036

High

Published: 27/05/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

The vulnerability in Square Squash allows remote attackers to execute arbitrary code by manipulating a YAML document in the namespace or sourcemap parameters in the deobfuscation and sourcemap functions.

Risk Assessment

Attackers can exploit this vulnerability to remotely execute code, potentially leading to system compromise or data leakage.

Recommendation

It is recommended to update the application to the latest version that fixes this vulnerability and to review and restrict access to functions processing YAML documents.

Other vulnerabilities in Square Squash

CVE-2026-109391High
Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.

Original NVD description (English source)

The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation function or (2) sourcemap parameter to the sourcemap function in app/controllers/api/v1_controller.rb.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS