React is rendering this h1 with style props passed through. Since v15 React updates the style properties on an element directly instead of setting a style attribute. As a result the style is displayed and isn't blocked by CSP
Back