CSP allows blob:
The policy allows blob: as a source.
Why it matters
blob: URLs can be created by script at runtime and used to load code the policy did not name.
What to do
Remove blob: unless a feature truly needs it, and keep script-src tight.
Reference
CSP Level 3 defines the directives and source lists this check evaluates.