CVE-2026-53510 with a CVSS score of 8.1 is a vulnerability affecting savon versions >= 0.9.8, < 2.17.2 in the Savon library, specifically in the.all_operations class method provided by Savon::Model to automatically register all operations provided by the WSDL. An attacker who can control the operation names of a WSDL can inject Ruby code that executes in the application process. This affects only the.all_operations class method provided by Savon::Model to automatically register all operations provided by the WSDL, and configuring Savon::Model with trusted operation names via.operations is safe. The vulnerability occurs when Savon::Model evaluates WSDL operation names as Ruby source, allowing an attacker to inject malicious code that executes in the application process. This flaw type is a CWE-94, which involves the injection of malicious code into a system through a vulnerable function or method. The business impact of this vulnerability is significant, as it allows an attacker to execute arbitrary code on the system, potentially leading to data breaches, unauthorized access, and other malicious activities.
We recommend you to update Savon to version 2.17.2.[/subscribe_to_unlock_form]
CVE-2026-53510 with a CVSS score of 8.1 is a vulnerability affecting savon versions >= 0.9.8, < 2.17.2 in the Savon library, specifically in the.all_operations class method provided by Savon::Model to automatically register all operations provided by the WSDL. An attacker who can control the operation names of a WSDL can inject Ruby code that executes in the application process. This affects only the.all_operations class method provided by Savon::Model to automatically register all operations provided by the WSDL, and configuring Savon::Model with trusted operation names via.operations is safe. The vulnerability occurs when Savon::Model evaluates WSDL operation names as Ruby source, allowing an attacker to inject malicious code that executes in the application process. This flaw type is a CWE-94, which involves the injection of malicious code into a system through a vulnerable function or method. The business impact of this vulnerability is significant, as it allows an attacker to execute arbitrary code on the system, potentially leading to data breaches, unauthorized access, and other malicious activities.
We recommend you to update Savon to version 2.17.2.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]