What is the CVSS score of CVE-2026-53510?

CVE-2026-53510 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Savon are affected by CVE-2026-53510?

The Savon Ruby SOAP client (versions 0.9.8-2.17.1) contains a code injection vulnerability enabling remote code execution when processing malicious WSDL documents through the…. A patch is available.

How to fix or mitigate CVE-2026-53510?

Within 24 hours, audit all applications and services to identify those using Savon gem versions 0.9.8 through 2.17.1 by reviewing Gemfile.lock files, dependency manifests, and package managers across your infrastructure. Within 7 days, upgrade all affected Savon installations to version 2.17.2 or later, prioritizing production environments and validating each upgrade in staging before deploying to production. Within 30 days, conduct a source code review to identify and restrict all calls to `Savon::Model.all_operations` to trusted WSDL sources only, and implement network allowlisting controls for external WSDL document integrations.

Savon CVE-2026-53510

EUVD-2026-51624 HIGH

Code Injection (CWE-94)

2026-07-31 GitHub_M

GHSA-mx5j-mp4f-g8jg

RCE Code Injection Savon

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 31, 2026 - 21:02 EUVD

Source Code Evidence Fetched

Jul 31, 2026 - 20:16 vuln.today

Analysis Generated

Jul 31, 2026 - 20:16 vuln.today

CVE Published

Jul 31, 2026 - 19:38 cve.org

HIGH 8.1

DescriptionCVE.org

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.

AnalysisAI

Code injection in the Savon Ruby SOAP client (rubygems/savon versions 0.9.8 through 2.17.1) enables arbitrary Ruby code execution in the application process when Savon::Model.all_operations is called with an attacker-controlled WSDL document. WSDL operation names are interpolated directly into Ruby source strings passed to module_eval, allowing an attacker who serves or intercepts a malicious WSDL to escape the generated method definition and execute arbitrary code. No public exploit identified at time of analysis, though a proof-of-concept was confirmed during responsible disclosure; vendor patch was released as version 2.17.2.