CVE-2020-5217

CVE-2020-5217 describes a directive injection vulnerability in the Secure Headers RubyGem (versions before 3.8.0, 5.1.0, and 6.2.0). If user-supplied input containing a semicolon was passed to append/override_content_security_policy_directives, an attacker could inject new directives, potentially overriding critical security policies like script-src. This vulnerability has a CVSS score of 5.8 (Medium), indicating a network-based attack with low complexity and a potential impact on integrity (C:N/I:L/A:N). While it allows for policy manipulation, the "first one wins" rule for duplicate directives and alphabetical sorting of existing directives limit its full impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.