secure_headers builds the CSP header by concatenating directive strings. Prior to 7.3.0, the functions that generate sandbox, plugin_types, and report_to directives interpolate caller‑supplied input without sanitizing characters such as ';', carriage returns or newlines. Because of this, an attacker can inject an entire new CSP rule, for example a script-src 'unsafe-inline' *, positioned before the legitimate rule. This injected rule effectively bypasses the intended policy, allowing cross‑site scripting or exfiltration through CSP report URLs. The vulnerability is fixed in secure_headers 7.3.0.

The product affected is the secure_headers Ruby gem distributed by GitHub. All versions before 7.3.0 are vulnerable. Version 7.3.0 and later contain the fix that sanitizes directive strings.

The CVSS score of 4.7 indicates moderate severity. The EPSS score is below 1%, implying a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the threat actor to provide crafted input to SecureHeaders.override_content_security_policy_directives or to the append methods for the sandbox, plugin_types, or report_to directives. Based on the description, it is inferred that the attack vector would involve remote delivery of malicious data to the application code that calls these APIs, though the vulnerability can only be leveraged when such data propagates to the gem. Once exploited, the attacker can execute arbitrary scripts within the context of the protected application or exfiltrate data via CSP report mechanisms.