CVE-2024-54133 Possible Content Security Policy bypass in Action Dispatch

What is CVE-2024-54133?

CVE-2024-54133 is a low-severity cross-site scripting vulnerability in rails, published on 10 Dec 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Weakness: CWE-79

Which versions are affected by CVE-2024-54133?

9 open source packages ship an affected version, including rails and actionpack.

How do I fix CVE-2024-54133?

Upgrade rails to a fixed version for your release line: 7.0.9, 7.1.4, 7.2.2-2-0 or 8.0.1.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-54133 being exploited?

There is no known exploitation of CVE-2024-54133 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-rails-2024-54133, DEBIAN-CVE-2024-54133, GHSA-vfm5-rmrh-j26v, UBUNTU-CVE-2024-54133, openSUSE-SU-2025:14668-1, openSUSE-SU-2025:14669-1 and 23 more.