Skip to content
OpenAdvisories
Low · 2.3 CVE-2024-54133 BIT-rails-2024-54133EUVD-2024-3509GHSA-vfm5-rmrh-j26v

Possible Content Security Policy bypass in Action Dispatch

Published Dec 10, 2024 · Updated Mar 7, 2025 · Assigned by GitHub_M

Vendor: rails Product: rails Package: actionpack Package: rails Package: rails Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu

Description

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Affected products

VendorProductAffectedFixed
rails rails >= 5.2.0, < 7.0.8.7, >= 7.1.0, < 7.1.5.1, >= 7.2.0, < 7.2.2.1, >= 8.0.0, < 8.0.0.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 rails 2:7.2.2.1+dfsg-1 —
Debian 13 rails 2:7.2.2.1+dfsg-1 —
Debian 12 rails 2:6.1.7.10+dfsg-1~deb12u1 DSA-5881-1
Debian 11 rails 2:6.0.3.7+dfsg-2+deb11u3 DLA-4383-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 rails No fix yet —
Ubuntu 26.04 LTS rails No fix yet —
Ubuntu 25.10 rails No fix yet —
Ubuntu 24.04 LTS rails No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS rails No fix yet —
Ubuntu Pro 20.04 LTS rails No fix yet —
Ubuntu Pro 18.04 LTS rails No fix yet —
Ubuntu Pro 16.04 LTS rails No fix yet —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed rubygem-rails-8.0 +12 8.0.1-1.1 openSUSE-SU-2026:10362-1, openSUSE-SU-2026:10360-1, openSUSE-SU-2026:10345-1

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems actionpack >= 5.2.0, < 7.0.8.7 7.0.8.7 GHSA-vfm5-rmrh-j26v
RubyGems actionpack >= 7.1.0, < 7.1.5.1 7.1.5.1 GHSA-vfm5-rmrh-j26v
RubyGems actionpack >= 7.2.0, < 7.2.2.1 7.2.2.1 GHSA-vfm5-rmrh-j26v
RubyGems actionpack >= 8.0.0, < 8.0.0.1 8.0.0.1 GHSA-vfm5-rmrh-j26v

Advisories 29

References