AIKIDO-2026-143919

TL;DR

Savon::Model generates SOAP operation methods by interpolating WSDL operation names into a Ruby source string passed to module_eval. When all_operations auto-registers every operation from a WSDL, an attacker who controls the operation names can inject arbitrary Ruby that executes in the application process. Configuring operations explicitly with trusted names via operations is not affected. The fix replaces module_eval string interpolation with define_method, passing the operation name as a value instead of evaluated source.