---
id: CVE-2026-53510
title: Savon is a Ruby SOAP client
summary: >-
  Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model
  .all_operations interpolates attacker-controlled WSDL operation names into
  Ruby source passed to module_eval, allowing Ruby code execution in the
  application process. Thi…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
vendor: savon
product: savon
affected:
  - 'savon >= 0.9.8, < 2.17.2'
patched:
  - savon 2.17.2
published: '2026-07-31'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T20:55:04.493'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53510'
references:
  - url: >-
      https://github.com/savonrb/savon/commit/8f22eb543e7436f6247172c9be47e22792d375e9
    label: security-advisories@github.com
  - url: 'https://github.com/savonrb/savon/releases/tag/v2.17.2'
    label: security-advisories@github.com
  - url: 'https://github.com/savonrb/savon/security/advisories/GHSA-mx5j-mp4f-g8jg'
    label: security-advisories@github.com
  - url: >-
      https://github.com/rubysec/ruby-advisory-db/blob/master/gems/savon/CVE-2026-53510.yml
  - url: 'https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-53510'
  - url: 'https://github.com/advisories/GHSA-mx5j-mp4f-g8jg'
tags:
  - nvd
  - ghsa
  - rubygems
epss: 0.00687
epssPercentile: 0.5056
aliases:
  - GHSA-mx5j-mp4f-g8jg
ecosystem: rubygems
ingestedAt: '2026-07-31T20:02:43.047Z'
---

## Overview

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-53510)

Affected packages:

- `savon >= 0.9.8, < 2.17.2`

Patched in:

- `savon 2.17.2`

Source: https://github.com/advisories/GHSA-mx5j-mp4f-g8jg