Savon::Model evaluates WSDL operation names as Ruby source
Priority LOW 38CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00687 52nd percentileScored 2026-11-07
Fix Fixed savon (savonrb): 2.17.2savon (RubyGems): 2.17.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| savonrb | savon | 0.9.8 to before 2.17.2 | 2.17.2 | Patch available | CNA |
| — | savon (RubyGems) | 0.9.8 to before 2.17.2 | 2.17.2 | Patch available | GHSA-mx5j-mp4f-g8jg |
- savon Vendorsavonrb Affected 0.9.8 to before 2.17.2 Fixed in 2.17.2 Patch available CNA
- savon (RubyGems) Vendor— Affected 0.9.8 to before 2.17.2 Fixed in 2.17.2 Patch available GHSA-mx5j-mp4f-g8jg
Remediation
- Fix · CNA savon (savonrb) Fixed in 2.17.2
- Fix · GHSA-mx5j-mp4f-g8jg savon (RubyGems) Fixed in 2.17.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-53510
- 2026-10-03 Alias added: GHSA-mx5j-mp4f-g8jg
References
Other 6
- https://github.com/savonrb/savon/security/advisories/GHSA-mx5j-mp4f-g8jg
- https://github.com/savonrb/savon/commit/8f22eb543e7436f6247172c9be47e22792d375e9
- https://github.com/savonrb/savon/releases/tag/v2.17.2
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/savon/CVE-2026-53510.yml
- https://github.com/savonrb/savon
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-53510
Sources
- CVE-2026-53510 · CVE Program
- CVE-2026-53510 · NVD
- FIRST EPSS
- GHSA-mx5j-mp4f-g8jg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences