7 matches found
CVE-2026-53510
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...
CVE-2026-53510 Savon::Model evaluates WSDL operation names as Ruby source
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...
CVE-2026-53510
Savon (Ruby SOAP client) contains a vulnerability in Savon::Model.all_operations, which interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing arbitrary code execution in the application process. Affected versions are 0.9.8 through 2.17.1; the issue...
CVE-2026-53510 Savon::Model evaluates WSDL operation names as Ruby source
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...
EUVD-2026-51624
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...
CVE-2026-53510
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...
Savon::Model evaluates WSDL operation names as Ruby source
Savon::Model generated SOAP operation methods by interpolating operation names into Ruby source passed to moduleeval. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the .alloperations class method provide...