Savon, a Ruby SOAP client, has a flaw in its .all_operations method that interpolates attacker‑controlled WSDL operation names into Ruby source code passed to module_eval, enabling the execution of arbitrary Ruby code within the application process. This provides an attacker with the ability to compromise application confidentiality, integrity, and availability by running malicious code under the application’s permissions.

The vulnerability affects all Savon Ruby SOAP client releases from version 0.9.8 up to and including 2.17.1. Users of these versions should verify the installed version and plan an upgrade to 2.17.2 or later where the issue has been corrected.

The CVSS score of 8.1 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests a low current likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. An attacker can exploit this by supplying a maliciously crafted WSDL file to a Savon client, which will interpret the operation names as Ruby code and execute them in the application’s process context.