For context, see this GitHub issue: https://github.com/codemirror/CodeMirror/issues/4937 https://github.com/codemirror/CodeMirror/issues/4937 Author is unwilli

For context, see this GitHub issue: https://github.com/codemirror/CodeMirror/issues/4937 https://github.com/codemirror/CodeMirror/issues/4937 Author is unwilling to change a handful lines of code to make the package compatible with a strict style-src. Why does this matter? You can exfiltrate data such as CSRF tokens using inline styles from a HTML injection vulnerability: https://medium.com/bugbountywriteup/exfiltration-via-css-injection-4e999f63097d https://medium.com/bugbountywriteup/exfiltration-via-css-inj...