I'm wondering if I'm risking anything if I use
style-src-attr 'unsafe-hashes' <hash>
in my CSP header.
Really you have only one "risk" here - after changing content of
style='...' you need to recalc hashes operatively. Otherwise styles will not apply and external wdget will not look propertly or work at all. And external widgets can correct their styles any moment.
I need to allow an external script to run, and it uses the style
attribute on some elements.
I have no control over the external script, and if there is a
malicious person behind it, what might an attack vector be?
(considering unsafe-inline has not been added)
If you have third party script running, the "style attrubutes" is a last thing you need to worry about. Moreover, script can change/add style attributes in absence of 'unsafe-inline' in style-src.
Third-party script can do a lot, for example, redirect all traffic to another site or inject Ads.
His possibilities to harm restrict by others CSP directives, but not the
How can a style attribute execute scripts or access my DOM or
otherwise cause anything harmful to happen?
There is no way to execute script over style attribute.
Yes, by change style attribute your page could look diffrerent way, but it need a script to do that. Therefore ref to para above.
Really by using styles without scripting is possible a few CSSAR (CSS Attribute Reading) attacks of reading tag attributes with CSS selectors, but it need to have wide open
IMHO the danger of 'unsafe-inline' in styles is greatly exaggerated, and when third-party scripts are connected, you don't even need to worry about styles.
PS: Styles is a low risk vector of attack, that is why CSP3 spec provides unsafe-eval even for styles, but that was never implemented in any browser.
It need to avoid
'unsafe-inline' in styles only on pages where your app work with bank cards.