CSP allows unsafe-inline
Content-Security-Policy includes 'unsafe-inline', so the browser may run inline scripts or styles.
Why it matters
unsafe-inline weakens the main XSS protection CSP is for. An injected <script> or event handler is allowed by the policy.
What to do
Remove 'unsafe-inline'. Allow specific inline scripts with a nonce or a hash instead.
Reference
CSP Level 3 defines the directives and source lists this check evaluates.