secure_headers builds the Content-Security-Policy header by concatenating directives. Three directive builders (for :sandbox, :plugin_types, and :report_to) interpolate caller-supplied strings without sanitizing semicolons, carriage returns, or newlines. This enables attackers to inject additional CSP directives, including a script-src directive with 'unsafe-inline', which takes precedence due to CSP's first-occurrence rule, effectively bypassing the configured strict script-src policy. This can lead to full XSS exploitation where untrusted input reaches these directives. Additionally, attackers can redirect CSP violation reports to their infrastructure, leaking sensitive information. The vulnerability affects versions prior to 7.3.0, which introduced proper sanitization. Applications using static values for these directives are not vulnerable, but those passing user-controlled input must upgrade and sanitize inputs.

An attacker able to supply untrusted input to the vulnerable CSP directives can inject arbitrary CSP directives, including a permissive script-src 'unsafe-inline' policy, enabling cross-site scripting (XSS) attacks despite a strict global CSP. This undermines the security guarantees of the CSP, potentially allowing script injection and execution. Additionally, attackers can redirect CSP violation reports to attacker-controlled endpoints, leaking URLs, source files, and other sensitive data useful for reconnaissance. Applications not passing user input to these directives are not impacted. The vulnerability is moderate in severity due to the requirement of user input control and some attack complexity.

Upgrade to secure_headers version 7.3.0 or later, which includes the fix that properly sanitizes input for the affected CSP directives. Until upgrading, sanitize any user-controlled input passed to :sandbox, :plugin_types, or :report_to directives by rejecting or stripping semicolons (';'), carriage returns ('\r'), and newlines ('\n') before passing them to SecureHeaders.override_content_security_policy_directives, append_content_security_policy_directives, or use_content_security_policy_named_append. Applications that only use static values for these directives do not require additional action beyond upgrading.