The secure_headers RubyGem manages security headers with safe defaults but prior to version 7.3.0, it constructs the Content-Security-Policy header by concatenating directives separated by semicolons. Certain methods (build_sandbox_list_directive, build_media_type_list_directive, build_report_to_directive) interpolate caller-supplied strings without sanitizing characters like semicolon, carriage return, or newline. If untrusted input reaches the override_content_security_policy_directives or append APIs for :sandbox, :plugin_types, or :report_to, an attacker can inject additional CSP directives (e.g., script-src 'unsafe-inline' *) before the legitimate ones. This enables XSS reachability or CSP report exfiltration. The vulnerability is fixed in version 7.3.0.

An attacker able to supply untrusted input to the affected APIs can inject malicious CSP directives, potentially enabling cross-site scripting attacks or leaking CSP reports. The CVSS 3.1 score is 4.7 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Upgrade secure_headers to version 7.3.0 or later, where this vulnerability is fixed. Prior versions improperly sanitize input to CSP directives, allowing injection. No other mitigations are specified or recommended by the vendor.