https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 11:56:52 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-343502 EUVD-2026-343502 https://cve.radiocsirt.org/vuln/euvd-2026-343502 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53510 <p>Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.</p> <p>Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53510 https://cve.radiocsirt.org/vuln/ghsa-mx5j-mp4f-g8jg <p><strong>Affected:</strong> RubyGems: savon</p> <p>### Impact</p> <p>`Savon::Model` generated SOAP operation methods by interpolating operation names into Ruby source passed to `module_eval`. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the `.all_operations` class method provided by `Savon::Model` to automatically register all operations provided by the WSDL. Configuring `Savon::Model` with trusted operation names via `.operations` is safe.</p> <p>### Patches</p> <p>Patched in Savon 2.17.2.</p> <p>Users should upgrade to 2.17.2 or later.</p> <p>### Workarounds</p> <p>Avoid `.all_operations` for untrusted WSDL documents. Use `.operations` with trusted operation names instead.</p> <p><strong>Affected:</strong> RubyGems: savon</p> <p>### Impact</p> <p>`Savon::Model` generated SOAP operation methods by interpolating operation names into Ruby source passed to `module_eval`. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the `.all_operations` class method provided by `Savon::Model` to automatically register all operations provided by the WSDL. Configuring `Savon::Model` with trusted operation names via `.operations` is safe.</p> <p>### Patches</p> <p>Patched in Savon 2.17.2.</p> <p>Users should upgrade to 2.17.2 or later.</p> <p>### Workarounds</p> <p>Avoid `.all_operations` for untrusted WSDL documents. Use `.operations` with trusted operation names instead.</p> https://cve.radiocsirt.org/vuln/ghsa-mx5j-mp4f-g8jg