Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-53510

Savon::Model evaluates WSDL operation names as Ruby source

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

savonrb savon

  • >= 0.9.8, < 2.17.2affected

References