Skip to content
OpenAdvisories

Package · Debian

ruby-secure-headers

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.7
    CVE-2026-54163

    secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input

    secure_headers manages application of security headers with many safe defaults. Prior to 7.3.0, secure_headers builds the Content-Security-Policy value by stitching directives with ; separators, and build_sandbox_list_directive, build_media_type_list_directiv…

    GitHub secure_headers ruby-secure-headers secure_headers Debian Ubuntu RubyGems
  • Medium 4.4
    CVE-2020-5216

    Limited header injection when using dynamic overrides with user input in RubyGems secure_headers

    In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leadi…

    Twitter secure_headers ruby-secure-headers secure_headers Debian Ubuntu RubyGems
  • Medium 4.4
    CVE-2020-5217

    Directive injection when using dynamic overrides with user input in RubyGems secure_headers

    In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected lea…

    Twitter secure_headers secure_headers ruby-secure-headers Debian Ubuntu RubyGems