github.com
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/savon/CVE-2026-53510.yml CVE-2026-53510
HIGH
Savon::Model evaluates WSDL operation names as Ruby source
Record summary
CVE-2026-53510 has a selected CVSS score of 8.1 (high).
Description
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 31, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | >= 0.9.8, < 2.17.2 | affected | |
| GitHub Advisory | 0.9.8 to < 2.17.2 · Fixed in 2.17.2 | affected |
References
6github.com
https://github.com/savonrb/savon github.com
https://github.com/savonrb/savon/commit/8f22eb543e7436f6247172c9be47e22792d375e9 github.com
https://github.com/savonrb/savon/releases/tag/v2.17.2 github.comConfirmation
https://github.com/savonrb/savon/security/advisories/GHSA-mx5j-mp4f-g8jg cve.org
https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-53510