### [CVE-2019-11738](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11738)
![](https://img.shields.io/static/v1?label=Product&message=Firefox%20ESR&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Firefox&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2068.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2069%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Content%20security%20policy%20bypass%20through%20hash-based%20sources%20in%20directives&color=brighgreen)

### Description

If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed. This could allow for malicious JavaScript content to be run, bypassing CSP permissions. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.

### POC

#### Reference
- https://bugzilla.mozilla.org/show_bug.cgi?id=1452037
- https://bugzilla.mozilla.org/show_bug.cgi?id=1452037

#### Github
No PoCs found on GitHub currently.