Seems to me like a CSP bypass bug that all implementors of svg fonts (cough, cough, webkit) should fix :)