Comment by yread

   content-security-policy: default-src 'self';

(and not sending crypto transactions): No need to worry about CVEs in js