DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-53510: CVE-2026-53510: Remote Code Execution via Dynamic WSDL Parsing in Savon Ruby SOAP Client

#security #cve #cybersecurity

CVE-2026-53510: Remote Code Execution via Dynamic WSDL Parsing in Savon Ruby SOAP Client

Vulnerability ID: CVE-2026-53510
CVSS Score: 8.1
Published: 2026-07-31

A critical code injection vulnerability exists in Savon, a widely used SOAP client library for Ruby, prior to version 2.17.2. The vulnerability resides within the Savon::Model.all_operations module, where operation names fetched from a target Web Services Description Language (WSDL) document are dynamically evaluated via module_eval without sanitization. An attacker capable of manipulating the target WSDL document (e.g., through Man-in-the-Middle attacks, DNS hijacking, or Server-Side Request Forgery) can execute arbitrary Ruby code in the context of the parent application process.

TL;DR

Unsanitized WSDL operation names are interpolated directly into double-quoted strings within module_eval in Savon < 2.17.2. This enables remote code execution when parsing a malicious or compromised WSDL document.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-94: Improper Control of Generation of Code ('Code Injection')
  • Attack Vector: Network (with High Complexity)
  • CVSS v3.1 Score: 8.1
  • Exploit Status: Proof of Concept (PoC) documented in test suite
  • CISA KEV Status: Not listed
  • Remediation Status: Patched in Version 2.17.2

Affected Systems

  • Ruby applications using Savon client library configured with Savon::Model.all_operations mapping.
  • savon: >= 0.9.8, < 2.17.2 (Fixed in: 2.17.2)

Code Analysis

Commit: 8f22eb5

Remove dynamic evaluation (module_eval) in class and instance operation definitions, migrating to define_method.

@@ -28,20 +28,25 @@ def all_operations

     # Defines a class-level SOAP operation.
     def define_class_operation(operation)
-      class_operation_module.module_eval %{
-        def #{StringUtils.snakecase(operation.to_s)}(locals = {})
-          client.call #{operation.inspect}, locals
-        end
-      }, __FILE__, __LINE__ - 4
+      method_name = operation_method_name(operation)
+
+      class_operation_module.define_method(method_name) do |locals = {}|
+        client.call operation, locals
+      end
     end
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub Security Advisory: Advisory text containing detailed Proof of Concept with structured XML entities inside operation names.

Mitigation Strategies

  • Upgrade the Savon gem to version 2.17.2 or later to eliminate module_eval usage.
  • Decline to use the dynamic Savon::Model.all_operations initializer for mapping SOAP endpoints.
  • Hardcode trusted operations explicitly using the .operations method configuration.
  • Enforce strict HTTPS with certificate verification for all remote WSDL endpoints.

Remediation Steps:

  1. Open the application Gemfile and update the dependency statement to: gem 'savon', '>= 2.17.2'
  2. Execute 'bundle update savon' to install the security patch and update the Gemfile.lock.
  3. Scan the codebase for references to Savon::Model.all_operations and replace them with explicit static definitions where applicable.
  4. Audit active network egress routes to ensure all SOAP and WSDL requests are directed over verified TLS channels.

References

Read the full report for CVE-2026-53510 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)