Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

savon

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1RubyGemsAmendedPublished

    Savon::Model evaluates WSDL operation names as Ruby source

    CVE-2026-53510 · GHSA-mx5j-mp4f-g8jg

    Affected
    • RubyGems savon >= 0.9.8, < 2.17.2
    Fixed in
    2.17.2· Vendor fix available
    Issue
    Impact Savon::Model generated SOAP operation methods by interpolating operation names into Ruby source passed to moduleeval. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the .alloperations class method provided by Savon::Model to automatically register all operations provided by the WSDL. Configuring Savon::Model with trusted operation names via .operations is safe. Patches Patched in Savon 2.17.2. Users should upgrade to 2.17.2 or later. Workarounds Avoid .alloperations for untrusted WSDL documents. Use .operations with trusted operation names instead.

    Recommended action: Upgrade to 2.17.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →