CVE-2024-54133: Rails

Low severity, CVSS 2.3. EPSS: 1% chance of exploitation in the next 30 days.

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Affected products

• Rails Rails: from 5.2.0, before 7.0.8.7 (fixed in 7.0.8.7); from 7.1.0, before 7.1.5.1 (fixed in 7.1.5.1); from 7.2.0, before 7.2.2.1 (fixed in 7.2.2.1); from 8.0.0, before 8.0.0.1 (fixed in 8.0.0.1)

Published 2024-12-10. Last modified 2026-06-17.