Hacker News Reader

Isn't the script injected inline in the HTML here? I have only little experience with CSP but wouldn't it only prevent from loading external scripts?

CSP affects inline scripts as well. They are actually disallowed by default and must be explicitly whitelisted.