CVE-2024-29896: Content-Security-Policy header generation in middleware could be compromised by malicious injections

When the following conditions are met:

• Automated CSP headers generation for SSR content is enabled
• The web application serves content that can be partially controlled by external users

Then it is possible that the CSP headers generation feature might be “allow-listing” malicious injected resources like inlined JS, or references to external malicious scripts.