Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed…

CVE-2026-53510 affects Savon, a Ruby SOAP client library, across versions 0.9.8 through 2.17.2. The vulnerability exists in the Savon::Model .all_operations method, which interpolates attacker-controlled WSDL operation names into Ruby source code passed to module_eval. This allows an attacker who can supply a malicious WSDL to achieve arbitrary Ruby code execution within the application process. The flaw is classified as a code injection vulnerability stemming from unsafe use of eval with untrusted input. The issue has been patched in version 2.17.2 of the Savon gem. Users are strongly advised to upgrade to the fixed version immediately. References include the fix commit, the release tag, and the GitHub security advisory GHSA-mx5j-mp4f-g8jg.