How many CVEs does GitHub secure_headers have?

GitHub secure_headers has 3 published CVE records since 2020.

How many GitHub secure_headers CVEs are in CISA KEV?

None of GitHub secure_headers's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for GitHub secure_headers vulnerabilities?

No GitHub secure_headers CVEs currently have a tracked public exploit in this dataset.

Which versions of GitHub secure_headers are affected?

95 distinct GitHub secure_headers versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in GitHub secure_headers CVEs?

GitHub secure_headers's CVEs most often map to these CWE weakness types: CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')).

What is the average severity of GitHub secure_headers CVEs?

The average CVSS base score across GitHub secure_headers's scored CVEs is 5.4.

GitHub secure_headers Vulnerabilities: CVEs, CISA KEV & Security Advisories

Affected versions and CVEs

Browse every GitHub secure_headers version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

0.4.23 CVEs
0.4.33 CVEs
1.1.13 CVEs
1.3.23 CVEs
1.3.33 CVEs
1.3.43 CVEs
2.0.03 CVEs
2.0.0.pre3 CVEs
2.0.13 CVEs
2.0.23 CVEs
2.1.03 CVEs
2.2.03 CVEs
2.2.13 CVEs
2.2.23 CVEs
2.2.33 CVEs
2.2.43 CVEs
2.3.03 CVEs
2.4.03 CVEs
2.4.13 CVEs
2.4.23 CVEs
2.4.33 CVEs
2.4.43 CVEs
3.0.03 CVEs
3.0.0.rc13 CVEs
3.0.13 CVEs
3.0.23 CVEs
3.0.33 CVEs
3.1.03 CVEs
3.1.13 CVEs
3.1.23 CVEs
3.2.03 CVEs
3.3.03 CVEs
3.3.13 CVEs
3.3.23 CVEs
3.4.03 CVEs
3.4.13 CVEs
3.5.03 CVEs
3.5.0.pre3 CVEs
3.5.13 CVEs
3.6.03 CVEs
3.6.13 CVEs
3.6.33 CVEs
3.6.43 CVEs
4.0.03 CVEs
4.0.0.alpha013 CVEs
4.0.0.alpha023 CVEs
4.0.0.alpha033 CVEs
4.0.0.alpha043 CVEs
4.0.13 CVEs
5.0.0.alpha013 CVEs
5.0.13 CVEs
5.0.23 CVEs
5.0.33 CVEs
5.0.43 CVEs
5.0.53 CVEs
6.0.0.alpha013 CVEs
6.0.0.alpha023 CVEs
6.0.0.alpha033 CVEs
6.1.03 CVEs
6.1.13 CVEs
6.1.23 CVEs
v.2.0.0.pre23 CVEs
3.6.52 CVEs
3.6.72 CVEs
3.7.02 CVEs
3.7.12 CVEs
3.7.22 CVEs
3.7.32 CVEs
3.7.42 CVEs
6.2.02 CVEs
3.8.01 CVE
5.1.01 CVE
6.3.01 CVE
6.3.11 CVE
6.3.21 CVE
6.3.31 CVE
6.3.41 CVE
6.4.01 CVE
6.5.01 CVE
6.6.01 CVE
6.7.01 CVE
7.0.01 CVE
7.1.01 CVE
7.2.01 CVE

Version ranges

< 7.3.01 CVE

Fixed in

0c8f0968f292ef699ac997b2085fe8ca6e87e6211 CVE
1298905068931621a2c1988b175a1da186bcd6411 CVE
14d72d78aa2a9593f601543d19057b38f78825f31 CVE
286a79dea80c6a9be4ca93e0f284c923cf77e5391 CVE
301695706f6a70517c2a90c6ef9b32178440a2d01 CVE
40e45a1a69362f8839d34e0fe16a5750330f4c5f1 CVE
65e2b4887eb3aea4184d078ef1a949b59977d29f1 CVE
722a69051acce9d26ab0d0648fe10fd2ff77baa81 CVE
936a160e3e9659737a9f9eafce13eea36b5c9fa31 CVE
f06956d138f906c8fe32a9a706d36697168e0a551 CVE

Find a version

3 CVEs

Sort

secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input
CVE-2026-54163
Patch
CWE-79
Medium · CVSS 4.7
EPSS 0.3% (21th pct)2026-07-17
Medium vulnerability · 2020-01-23
CVE-2020-5216
Patch
CWE-113
Medium · CVSS 5.8
EPSS 1.1% (61th pct)2020-01-23
Medium vulnerability · 2020-01-23
CVE-2020-5217
Patch
CWE-95
Medium · CVSS 5.8
EPSS 1.8% (76th pct)2020-01-23

GitHub secure_headers Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Specific versions

Version ranges

Fixed in

Common weakness types

Disclosure activity by year

Other GitHub products

Frequently asked questions

References

Track GitHub secure_headers vulnerabilities