secure_headers builds the Content-Security-Policy header by concatenating directives. Three directive builders (for :sandbox, :plugin_types, and :report_to) interpolate caller-supplied strings without sanitizing ';', '\r', or '\n'. This allows attackers who can influence these directives to inject arbitrary CSP directives, including a 'script-src' directive with 'unsafe-inline', which takes precedence due to CSP's first-occurrence rule. This breaks the intended strict CSP policy and enables cross-site scripting (XSS). The vulnerability affects versions prior to 7.3.0. Applications that only use static values for these directives are not exploitable. The issue is patched in version 7.3.0.

Applications using secure_headers <= 7.2.0 that pass untrusted input into the :sandbox, :plugin_types, or :report_to CSP directives can have their CSP header manipulated to allow unsafe inline scripts, effectively enabling XSS attacks despite strict global CSP configurations. Additionally, attackers can redirect CSP violation reports to attacker-controlled infrastructure, leaking sensitive information about the victim's environment. This undermines the security guarantees of CSP and can lead to client-side code execution and information disclosure.

Upgrade secure_headers to version 7.3.0 or later, where this vulnerability is fixed. Until upgrading, sanitize any user-controlled input passed to SecureHeaders.override_content_security_policy_directives, append_content_security_policy_directives, or use_content_security_policy_named_append for the :sandbox, :plugin_types, or :report_to directives by rejecting or stripping ';', '\r', and '\n' characters. Applications that only use static values for these directives do not require additional mitigation beyond upgrading.