CSP allows data:
The policy allows data: for a script or object source.
Why it matters
data: can carry an inline payload, which is another way to run injected code.
What to do
Remove data: from script-src and object-src.
Reference
CSP Level 3 defines the directives and source lists this check evaluates.