https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T11:57:54.158105+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-343502 EUVD-2026-343502 2026-10-12T11:57:54.160439+00:00 EUVD-2026-343502 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53510 fkie_cve-2026-53510 2026-10-12T11:57:54.160467+00:00

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.

 https://cve.radiocsirt.org/vuln/ghsa-mx5j-mp4f-g8jg GHSA-mx5j-mp4f-g8jg — Savon::Model evaluates WSDL operation names as Ruby source 2026-10-12T11:57:54.160496+00:00

Affected: RubyGems: savon

### Impact

`Savon::Model` generated SOAP operation methods by interpolating operation names into Ruby source passed to `module_eval`. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the `.all_operations` class method provided by `Savon::Model` to automatically register all operations provided by the WSDL. Configuring `Savon::Model` with trusted operation names via `.operations` is safe.

### Patches

Patched in Savon 2.17.2.

Users should upgrade to 2.17.2 or later.

### Workarounds

Avoid `.all_operations` for untrusted WSDL documents. Use `.operations` with trusted operation names instead.