Content security policy: allows untrusted script execution
Summary: PortSwigger Research describes Content Security Policy as a mechanism that mitigates cross-site scripting by disabling dangerous behaviors such as untrusted JavaScript execution, specified by a site in a response header or meta tag. The guidance says to avoid 'unsafe-inline', 'unsafe-eval', data: URLs and global wildcards in script directives, and to use a secure random nonce of at least 8 characters to prevent untrusted JavaScript execution.
Bottom line: A CSP that permits 'unsafe-inline', 'unsafe-eval', data: URLs or wildcards leaves the untrusted script execution the policy exists to block, so the header can be present and still not stop cross-site scripting.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026