CVE-2026-53510: Savon::Model evaluates WSDL operation names as Ruby source
Savon::Model generated SOAP operation methods by interpolating operation names into Ruby source passed to module_eval. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the .all_operations class method provided by Savon::Model to automatically register all operations provided by the WSDL. Configuring Savon::Model with trusted operation names via .operations is safe.
References
- github.com/advisories/GHSA-mx5j-mp4f-g8jg
- github.com/rubysec/ruby-advisory-db/blob/master/gems/savon/CVE-2026-53510.yml
- github.com/savonrb/savon/commit/8f22eb543e7436f6247172c9be47e22792d375e9
- github.com/savonrb/savon/releases/tag/v2.17.2
- github.com/savonrb/savon/security/advisories/GHSA-mx5j-mp4f-g8jg
- nvd.nist.gov/vuln/detail/CVE-2026-53510
- www.cve.org/CVERecord/SearchResults?query=CVE-2026-53510
Code Behaviors & Features
Detect and mitigate CVE-2026-53510 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →