CVE-2026-54163

Name of the Vulnerable Software and Affected Versions secure headers versions prior to 7.3.0

Description The software fails to properly sanitize caller-supplied strings when building the Content-Security-Policy (CSP) header. Specifically, the functions build sandbox list directive(), build media type list directive(), and build report to directive() do not scrub semicolons (;), carriage returns (r), or newlines ( ).

When untrusted input is passed to the SecureHeaders.override content security policy directives or append APIs for the :sandbox, :plugin types, or :report to directives, an attacker can inject arbitrary CSP directives. Due to the CSP first-occurrence rule, an injected script-src 'unsafe-inline' * can override the application's legitimate security policy, enabling Cross-Site Scripting (XSS). Additionally, this can be used to redirect report-to or report-uri to attacker-controlled infrastructure to exfiltrate CSP violation reports, which may contain internal URLs and fingerprinting information.

Recommendations Update to version 7.3.0. As a temporary workaround, sanitize any user-controlled input by rejecting or stripping ;, r, and before passing it to SecureHeaders.override content security policy directives, SecureHeaders.append content security policy directives, or SecureHeaders.use content security policy named append for the :sandbox, :plugin types, or :report to directives.