CVE-2013-5036

Square Squash - Remote Code Execution via YAML in Namespace or Sourcemap Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2013-5036. PoCs published by Metasploit, Charlie Eriksen, including Metasploit module exploits/unix/webapp/squash_yaml_exec.

AI-analyzed exploit summary This Metasploit module exploits a YAML deserialization vulnerability in Squash, allowing remote code execution via crafted YAML payloads sent to the API endpoint. The exploit leverages Ruby's YAML parsing to execute arbitrary commands embedded in the payload.

Description

The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation function or (2) sourcemap parameter to the sourcemap function in app/controllers/api/v1_controller.rb.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/27530

This Metasploit module exploits a YAML deserialization vulnerability in Squash, allowing remote code execution via crafted YAML payloads sent to the API endpoint. The exploit leverages Ruby's YAML parsing to execute arbitrary commands embedded in the payload.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Squash (Ruby on Rails application)
No auth needed
Prerequisites: Network access to the target application · Vulnerable Squash API endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by Charlie Eriksen · rubypocruby
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/squash_yaml_exec.rb

This Metasploit module exploits a YAML deserialization vulnerability in Squash to achieve remote code execution. It crafts a malicious YAML payload containing base64-encoded Ruby code, which is then deflated and sent to the target endpoint.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Squash (version not specified, but CVE-2013-5036)
No auth needed
Prerequisites: Network access to the target application · Vulnerable Squash instance with exposed API endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/86335
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/27530
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/95992

Scores

EPSS 0.4618
EPSS Percentile 98.7%

Details

CWE
CWE-94
Status published
Products (1)
squash/square_squash
Published May 27, 2014
Tracked Since Feb 18, 2026