Bypassing Content-Security-Policy

When it applies

You have an injection point but CSP is stopping execution. CSP is a mitigation, not a fix — a weak policy still lets script run, and turning a "blocked" XSS into a firing one is what makes the bug real (and higher severity).

Why it works

Most deployed CSPs have a gap: an over-broad allowlist, a leftover unsafe-inline, a reusable nonce, a script-src host that also serves a JSONP/AngularJS gadget, or a missing base-uri/ object-src. Each gap is a path to execution the policy author didn't intend.