Vulnerability · Published Jul 31, 2026 · Assigned by GitHub_M
CVE-2026-53510Savon::Model evaluates WSDL operation names as Ruby source
High 8.1
In plain English
A high-severity code injection in savon from savonrb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.7%top 47.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| RubyGems | savon | 2.17.2 | GHSA-mx5j-mp4f-g8jg |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/savonrb/savon/security/advisories/GHSA-mx5j-mp4f-g8jg x_refsource_CONFIRM
- https://github.com/savonrb/savon/commit/8f22eb543e7436f6247172c9be47e22792d375e9 x_refsource_MISC
- https://github.com/savonrb/savon/releases/tag/v2.17.2 x_refsource_MISC