{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-10T12:33:57.087","vulnerabilities":[{"cve":{"id":"CVE-2024-54133","sourceIdentifier":"security-advisories@github.com","published":"2024-12-10T23:15:06.240","lastModified":"2026-04-15T00:35:42.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability  in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input."},{"lang":"es","value":"Action Pack es un framework para gestionar y responder a solicitudes web. Existe una posible vulnerabilidad de Cross Site Scripting (XSS) en el asistente `content_security_policy` a partir de la versión 5.2.0 de Action Pack y anteriores a las versiones 7.0.8.7, 7.1.5.1, 7.2.2.1 y 8.0.0.1. Las aplicaciones que establecen encabezados Content-Security-Policy (CSP) de forma dinámica a partir de una entrada de usuario no confiable pueden ser vulnerables a que las entradas cuidadosamente diseñadas puedan inyectar nuevas directivas en la CSP. Esto podría provocar una omisión de la CSP y su protección contra XSS y otros ataques. Las versiones 7.0.8.7, 7.1.5.1, 7.2.2.1 y 8.0.0.1 contienen una solución. Como workaround, las aplicaciones pueden evitar establecer encabezados CSP de forma dinámica a partir de una entrada no confiable, o pueden validar/sanear esa entrada."}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/rails/rails/commit/2e3f41e4538b9ca1044357f6644f037bbb7c6c49","source":"security-advisories@github.com"},{"url":"https://github.com/rails/rails/commit/3da2479cfe1e00177114b17e496213c40d286b3a","source":"security-advisories@github.com"},{"url":"https://github.com/rails/rails/commit/5558e72f22fc69c1c407b31ac5fb3b4ce087b542","source":"security-advisories@github.com"},{"url":"https://github.com/rails/rails/commit/cb16a3bb515b5d769f73926d9757270ace691f1d","source":"security-advisories@github.com"},{"url":"https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v","source":"security-advisories@github.com"},{"url":"https://security.netapp.com/advisory/ntap-20250306-0010/","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}