H3-2026-0071¶

Weak Content-Security-Policy Directives

Description¶

A web application returned a Content-Security-Policy header that contained unsafe directives: unsafe-inline, unsafe-eval, a wildcard (*) source, or a missing default-src.

Impact¶

Unsafe CSP directives weaken the protection that a Content-Security-Policy is meant to provide. The unsafe-inline and unsafe-eval directives let injected scripts run, a wildcard source allows any origin, and a missing default-src leaves unlisted resource types unrestricted. These lower the bar for cross-site scripting and injection, but constitute a gap in hardening rather than a directly exploitable weakness.

References¶

• OWASP Secure Headers Project: Content-Security-Policy
• CWE-693: Protection Mechanism Failure