RubyGems/secure_headers CVE-2026-54163: medium 4.7, EPSS 0.21%
Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input
Action: Upgrade secure_headers to 7.3.0 or later.
bundle update secure_headersAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 7.3.0 | - |
Fixed versions
| 7.3.0 |
Sources
- osv: GHSA-rqq5-2gf9-4w4q
- https://github.com/github/secure_headers/security/advisories/GHSA-rqq5-2gf9-4w4q
- https://github.com/github/secure_headers
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/secure_headers/CVE-2026-54163.yml
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54163
CVE-2026-54163 · published · modified · JSON