Remote Code Execution in Savon::Model via WSDL Injection

Savon, a popular Ruby client for SOAP web services, contains a critical vulnerability (CVE-2026-53510) in its Savon::Model component. The flaw exists in the .all_operations class method, which is designed to automatically register SOAP operations by parsing a WSDL document. During this process, the library interpolates operation names directly into a string that is passed to Ruby's module_eval function. An attacker capable of influencing the WSDL source (e.g., providing a URL to a malicious WSDL file or intercepting a legitimate service response) can inject arbitrary Ruby code. This code executes with the privileges of the application process. The vulnerability affects all versions of the savon gem from 0.9.8 up to 2.17.2. Applications that manually define operations via the .operations method are not affected, as this approach avoids the insecure string evaluation of untrusted metadata.

Impact

Successful exploitation allows for full remote code execution within the context of the Ruby application process. Depending on the environment, this could lead to sensitive data exfiltration, unauthorized modification of application logic, or complete system compromise. Organizations relying on automated service discovery via Savon::Model using user-supplied or network-reachable WSDL files are at high risk.

Recommendation

• Upgrade the savon gem to version 2.17.2 or later immediately to patch CVE-2026-53510.
• For applications that cannot immediately upgrade, transition away from the all_operations method in Savon::Model and explicitly define service operations using the .operations method with trusted input.
• Audit applications utilizing Savon::Model to identify instances where the WSDL source is fetched from external or untrusted origins.