GHSA-mx5j-mp4f-g8jg
Savon::Model evaluates WSDL operation names as Ruby source
Quick fix
GHSA-mx5j-mp4f-g8jg — savon: upgrade to the fixed version with the command below.
bundle update savonDetails
### Impact
`Savon::Model` generated SOAP operation methods by interpolating operation names into Ruby source passed to `module_eval`. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the `.all_operations` class method provided by `Savon::Model` to automatically register all operations provided by the WSDL. Configuring `Savon::Model` with trusted operation names via `.operations` is safe.
### Patches
Patched in Savon 2.17.2.
Users should upgrade to 2.17.2 or later.
### Workarounds
Avoid `.all_operations` for untrusted WSDL documents. Use `.operations` with trusted operation names instead.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/savonrb/savon/security/advisories/GHSA-mx5j-mp4f-g8jg [WEB]
- https://github.com/savonrb/savon/commit/8f22eb543e7436f6247172c9be47e22792d375e9 [WEB]
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/savon/CVE-2026-53510.yml [WEB]
- https://github.com/savonrb/savon [PACKAGE]
- https://github.com/savonrb/savon/releases/tag/v2.17.2 [WEB]
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-53510 [WEB]