If I allow base64 encoded images to load on my website, but I do not have unsafe-eval enabled, nor have I allowed 'inline-script' would my site still be at risk by allowing base64 encoded image data to be painted onto images that might have malicious script inside?

1 Answer 1


A base64 encoded image inside a <img src="data:..."> will not execute any script, no matter if unsafe-eval is enabled or not. It will only display the image. It does not matter if the image contains any script since the browser will treat it only like a dumb image inside the context of the img tag.

  • Is this legit secjuice.com/hiding-javascript-in-png-csp-bypass Dec 11, 2020 at 16:29
  • this might be a better post of how script injection is happening through a data uri (base65 encoded image) nccgroup.com/us/about-us/newsroom-and-events/blog/2019/april/… Dec 11, 2020 at 16:34
  • 1
    @user1709076: None of these examples execute script inside the image-context. The first one explicitly uses script outside the image in order to load the image and interpret it as Javascript. The problem here is not the base64 image but the malicious script outside which interprets parts of the image as script. The image by itself is harmless. And the malicious script would not actually need the image - all the maliciousness could have been already in the script itself. Its just to obfuscate and keep it smaller. Dec 11, 2020 at 16:37
  • 1
    @user1709076: No attacks are shown in this article with img-tag, only within object. Again img enforces image context and the data are thus interpreted as image and not script. Dec 14, 2020 at 19:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .