"cypress-axe": "^0.14.0" Blocked by Cors 'unsafe-eval'

Packages:

        "cypress": "^9.7.0",
        "axe-core": "^4.4.2",
        "cypress-axe": "^0.14.0",

Error:

Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 

Code Triggering Error:

node_modules/cypress-axe/dist/index.js

exports.injectAxe = function () {
    var fileName = typeof (require === null || require === void 0 ? void 0 : require.resolve) === 'function'
        ? require.resolve('axe-core/axe.min.js')
        : 'node_modules/axe-core/axe.min.js';
    cy.readFile(fileName).then(function (source) {
        return cy.window({ log: false }).then(function (window) {

            window.eval(source);  // Triggers Cors error.

        });
    });
};

Start with node_modules/cypress-axe/dist/index.js and its injectAxe entry point, using the listed Cypress, axe-core, and cypress-axe versions to reproduce the Content Security Policy error. Trace how axe-core is loaded through cy.readFile and cy.window, then verify that accessibility checks still run without triggering the unsafe-eval violation.