Executive brief
Savon is a popular Ruby library used by applications to communicate with web services via the SOAP protocol. A security flaw in the library's model component allows an attacker to execute arbitrary code on the server if they can control the service definition (WSDL) file processed by the application. This could lead to a full system takeover, data theft, or disruption of services.
Technical details
A code injection vulnerability exists in Savon versions 0.9.8 through 2.17.1 within the Savon::Model component. The .all_operations class method, which automatically registers SOAP operations from a WSDL document, fails to sanitize operation names before interpolating them into a string passed to module_eval. An attacker who can provide a malicious WSDL document or perform a Man-in-the-Middle (MitM) attack on a WSDL fetch can inject arbitrary Ruby code into the application process. The vulnerability is mitigated if developers use the .operations method with a static list of trusted operation names instead of .all_operations. This issue is fixed in version 2.17.2.
Affected products
- savonrb savon >= 0.9.8, < 2.17.2
Timeline
- 2026-05-31: patched: Initial fix commit authored.
- 2026-06-10: advisory: GitHub Security Advisory published.
- 2026-07-31: disclosed: CVE published to NVD.