CVE-2024-54133: Possible Content Security Policy bypass in Action Dispatch

Severity: low (CVSS 2.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-10 · updated 2026-06-17
Weakness: CWE-79

Description

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Affected products

Rubygems Actionpack: from 5.2.0 before 7.0.8.7; from 7.1.0 before 7.1.5.1; from 7.2.0 before 7.2.2.1; from 8.0.0 before 8.0.0.1; 5.2.0, 5.2.1, 5.2.1.1, 5.2.1.rc1, 5.2.2, 5.2.2.1 (+136) — fixed in 7.0.8.7, 7.1.5.1, 7.2.2.1, 8.0.0.1
Ruby on Rails: from 5.2.0, < 7.0.8.7; from 7.1.0, < 7.1.5.1; from 7.2.0, < 7.2.2.1; from 8.0.0, < 8.0.0.1

How to fix

Upgrade to a fixed version: Rubygems Actionpack 7.0.8.7, 7.1.5.1, 7.2.2.1, 8.0.0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-54133 or the next vulnerability affects your stack