CSP allows unsafe-eval
Content-Security-Policy includes 'unsafe-eval', so eval() and similar string-to-code APIs are allowed.
Why it matters
That reopens a class of XSS where attacker-controlled text is executed as JavaScript.
What to do
Remove 'unsafe-eval' unless a library truly cannot run without it.
Reference
CSP Level 3 defines the directives and source lists this check evaluates.