Plack::Middleware::CSP versions before 0.03 for Perl incorrectly send the Content Security Policy using the header name "content-security-protocol" instead of the correct "Content-Security-Policy" header. As a result, browsers do not enforce the intended security policy, potentially allowing cross-site scripting (XSS) attacks to execute scripts that the policy was meant to block.