Content security policy: allows untrusted style execution
Summary: PortSwigger Research describes a Content Security Policy weakness in which a site's style directives permit untrusted style execution, undermining CSP's role in mitigating cross-site scripting by disabling dangerous behaviors such as untrusted JavaScript execution. The guidance is to avoid 'unsafe-inline', data: URLs, and global wildcards in style directives, and to use a secure random nonce of at least 8 characters in the relevant directive.
Key Takeaway: A policy that allows untrusted style execution leaves style-based data exfiltration open, which is why the source calls for dropping 'unsafe-inline', data: URLs, and global wildcards in favor of a random nonce of at least 8 characters.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026