CVE-2026-53510
Savon::Model evaluates WSDL operation names as Ruby source
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Savon::Model evaluates WSDL operation names as Ruby source
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.
- Record
CVE-2026-53510- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2026-51624
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.
- Record
EUVD-2026-51624- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mx5j-mp4f-g8jg
Savon::Model evaluates WSDL operation names as Ruby source
Impact
Savon::Model generated SOAP operation methods by interpolating operation names into Ruby source passed to module_eval. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the .all_operations class method provided by Savon::Model to automatically register all operations provided by the WSDL. Configuring Savon::Model with trusted operation names via .operations is safe.
Patches
Patched in Savon 2.17.2.
Users should upgrade to 2.17.2 or later.
Workarounds
Avoid .all_operations for untrusted WSDL documents. Use .operations with trusted operation names instead.
- Record
GHSA-mx5j-mp4f-g8jg- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.
- Record
CVE-2026-53510- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Savon::Model evaluates WSDL operation names as Ruby source
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.
- Record
CVE-2026-53510- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-mx5j-mp4f-g8jg
Savon::Model evaluates WSDL operation names as Ruby source
Impact
Savon::Model generated SOAP operation methods by interpolating operation names into Ruby source passed to module_eval. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the .all_operations class method provided by Savon::Model to automatically register all operations provided by the WSDL. Configuring Savon::Model with trusted operation names via .operations is safe.
Patches
Patched in Savon 2.17.2.
Users should upgrade to 2.17.2 or later.
Workarounds
Avoid .all_operations for untrusted WSDL documents. Use .operations with trusted operation names instead.
- Record
GHSA-mx5j-mp4f-g8jg- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
savonRubyGems |
0.9.8 up to 2.17.2 | 2.17.2 |
savonRubyGems |
0.9.8 up to 2.17.2, plus listed versions 0.9.100.9.110.9.140.9.91.0.0 Show 37 moreShow less1.1.01.2.02.0.02.0.12.0.22.0.32.1.02.10.02.10.12.11.02.11.12.11.22.12.02.12.12.13.02.13.12.14.02.15.02.15.12.16.02.17.02.17.12.2.02.3.02.3.12.3.22.3.32.4.02.5.02.5.12.6.02.7.02.7.12.7.22.8.02.8.12.9.0 |
2.17.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-53510 is a high vulnerability (CVSS 8.1) in Savonrb Savon, published July 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 52nd percentile. Fixed in savon 2.17.2.
References
github.com/savonrb/savon/security/advisories/GHSA-mx5j-mp4f-g8jg
cve.org/CVERecord/SearchResults?query=CVE-2026-53510
nvd.nist.gov/vuln/detail/CVE-2026-53510