NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
💎 RubyGems
Not in CISA KEV

Possible Content Security Policy bypass in Action DispatchGHSA-vfm5-rmrh-j26v

Fix: rails/rails@2e3f41e

GHSA-vfm5-rmrh-j26v is a Cross-site Scripting (XSS) vulnerability in actionpack. A fix is available for actionpack — see the affected versions and patch details below.

Also known asBIT-rails-2024-54133CVE-2024-54133
Published
Updated
Affected
4 pkgs
Patched
4 / 4
Exploits
None indexed
Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-vfm5-rmrh-j26v.

EPSS Exploitation Probability

via FIRST.org ↗
1.0%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs63th percentile — riskier than 63% of all scored CVEsHighest risk
0.00%0.50%1.01%1.51%0.2%1.0%1.0%1.0%1.0%Jun 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

4 pkgs affected
💎actionpack💎actionpack💎actionpack💎actionpack

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.

Description

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Affected Packages

4 total 4 fixed
EcosystemPackageVulnerable rangeFix
💎RubyGemsactionpack≥ 5.2.0&&< 7.0.8.77.0.8.7bundle update actionpack --conservative
💎RubyGemsactionpack≥ 7.1.0&&< 7.1.5.17.1.5.1bundle update actionpack --conservative
💎RubyGemsactionpack≥ 7.2.0&&< 7.2.2.17.2.2.1bundle update actionpack --conservative
💎RubyGemsactionpack≥ 8.0.0&&< 8.0.0.18.0.0.1bundle update actionpack --conservative

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for actionpack, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update actionpack to 7.0.8.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-vfm5-rmrh-j26v is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatLow
Workaround published by Red Hat
Applications can avoid setting CSP headers dynamically from untrusted input or can validate/sanitize that input.
Source: Red Hat security advisory for GHSA-vfm5-rmrh-j26v (CC BY 4.0)

Frequently Asked Questions

There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper in Action Pack. Impact ------ Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- Applications can avoid setting CSP headers dynamically from untrusted input, or c
O3 Security · Impact-Aware SCA

Is GHSA-vfm5-rmrh-j26v in your dependencies?

Find it across RubyGems, including transitive dependencies.

Scan my dependencies How O3 SCA works
Possible Content Security Policy bypass in Action Dispatch