GHSA-mx5j-mp4f-g8jg

Suggest an improvement
Source
https://github.com/advisories/GHSA-mx5j-mp4f-g8jg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mx5j-mp4f-g8jg/GHSA-mx5j-mp4f-g8jg.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-mx5j-mp4f-g8jg
Aliases
Published
2026-07-31T19:38:25Z
Modified
2026-07-31T19:45:09.782557996Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Savon::Model evaluates WSDL operation names as Ruby source
Details

Impact

Savon::Model generated SOAP operation methods by interpolating operation names into Ruby source passed to module_eval. An attacker who can control the operation names of a WSDL, can inject Ruby code that executes in the application process. This affects only the .all_operations class method provided by Savon::Model to automatically register all operations provided by the WSDL. Configuring Savon::Model with trusted operation names via .operations is safe.

Patches

Patched in Savon 2.17.2.

Users should upgrade to 2.17.2 or later.

Workarounds

Avoid .all_operations for untrusted WSDL documents. Use .operations with trusted operation names instead.

Database specific 
{
    "nvd_published_at": null,
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T19:38:25Z",
    "cwe_ids": [
        "CWE-94"
    ]
}
References

Affected packages

RubyGems / savon

Package

Name
savon
Purl
pkg:gem/savon

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.9.8
Fixed
2.17.2

Affected versions

0.*
0.9.8
0.9.9
0.9.10
0.9.11
0.9.14
1.*
1.0.0
1.1.0
1.2.0
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.1.0
2.2.0
2.3.0
2.3.1
2.3.2
2.3.3
2.4.0
2.5.0
2.5.1
2.6.0
2.7.0
2.7.1
2.7.2
2.8.0
2.8.1
2.9.0
2.10.0
2.10.1
2.11.0
2.11.1
2.11.2
2.12.0
2.12.1
2.13.0
2.13.1
2.14.0
2.15.0
2.15.1
2.16.0
2.17.0
2.17.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mx5j-mp4f-g8jg/GHSA-mx5j-mp4f-g8jg.json"