Search for packages
| purl | pkg:gem/actionpack@8.0.0.rc1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-g3rk-djae-pkeh
Aliases: CVE-2024-54133 GHSA-vfm5-rmrh-j26v |
Possible Content Security Policy bypass in Action Dispatch There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper in Action Pack. Impact ------ Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input. Credits ------- Thanks to [ryotak](https://hackerone.com/ryotak) for the report! |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-16T17:41:17.260189+00:00 | Ruby Importer | Affected by | VCID-g3rk-djae-pkeh | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-54133.yml | 38.4.0 |
| 2026-04-11T21:38:57.852191+00:00 | Ruby Importer | Affected by | VCID-g3rk-djae-pkeh | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-54133.yml | 38.3.0 |
| 2026-04-02T19:36:42.343109+00:00 | Ruby Importer | Affected by | VCID-g3rk-djae-pkeh | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-54133.yml | 38.1.0 |
| 2026-04-01T15:54:04.760291+00:00 | Ruby Importer | Affected by | VCID-g3rk-djae-pkeh | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-54133.yml | 38.0.0 |