CVE-2026-54163 Details
Description
secure_headers manages application of security headers with many safe defaults. Prior to 7.3.0, secure_headers builds the Content-Security-Policy value by stitching directives with ; separators, and build_sandbox_list_directive, build_media_type_list_directive, and build_report_to_directive interpolate caller-supplied strings without scrubbing ;, \r, or \n. When untrusted input reaches SecureHeaders.override_content_security_policy_directives or append APIs for :sandbox, :plugin_types, or :report_to, an attacker can inject a CSP directive such as script-src 'unsafe-inline' * before the legitimate script-src, enabling XSS reachability through these sinks or CSP report exfiltration. This issue is fixed in version 7.3.0.
A vulnerability in the Secure Headers gem for Ruby has been identified, allowing for injection of Content Security Policy (CSP) directives via the sandbox, plugin-types, and report-to fields. This issue affects versions of Secure Headers through 7.2.0. The vulnerability arises because these directive builders do not properly sanitize user-supplied input, allowing attackers to inject arbitrary CSP directives that could, for example, enable cross-site scripting (XSS) attacks by manipulating script-src policies. The vulnerability can be exploited by applications that forward untrusted input into these CSP directives, particularly through per-controller override APIs.
Upgrade to Secure Headers version 7.3.0 or later, and audit any code that passes user-controlled input into the CSP directives for sandbox, plugin-types, or report-to. If the input is not sanitized, it could be exploited to inject harmful CSP directives.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/github/secure_headers/security/advisories/GHSA-rqq5-2gf9-4w4q | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/github/secure_headers/commit/286a79dea80c6a9be4ca93e0f284c923cf77e539 | [email protected] | Source CodeVendor |
| https://github.com/github/secure_headers/releases/tag/v7.3.0 | [email protected] | Release NotesVendor |
| https://github.com/github/secure_headers/security/advisories/GHSA-rqq5-2gf9-4w4q | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| secure_headers | <= 7.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |