AIKIDO-2024-10532

TL;DR

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper handling of Content-Security-Policy (CSP) headers. Applications that dynamically generate CSP headers using untrusted user input are at risk, as attackers can craft inputs that inject malicious directives into the CSP. This vulnerability can effectively bypass the CSP, undermining its protections against XSS and other web-based attacks, potentially compromising the security of the application and its users. While a fix for this issue was introduced in Rails core, the affected package implemented its own mitigation measures to address the risk.