CVE-2026-53510
HIGH · 8.1Real vuln with fix, researcher PoC methodology shared, but no KEV/in-wild evidence yet.
What: Savon Ruby SOAP client (versions 0.9.8–2.17.2) allows remote code execution via unsafe interpolation of WSDL operation names into module_eval, enabling arbitrary Ruby code execution. CVSS 8.1 (HIGH).
Why it matters: Published 31 July 2026; researcher disclosed discovery with working methodology (Claude + Scrutineer). Fix available in 2.17.2. No KEV listing yet, but RCE severity and patched release signal legitimate vulnerability requiring immediate triage by Ruby/SOAP users.
Where it's seen: Researcher disclosure on social media, technical summaries circulating, vulnerability aggregators picking it up same day. Early-stage chatter with confirmation of patch availability.
RISK: HIGH — RCE in Ruby SOAP library affecting interpolated code execution; patch available.
Description
Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High