diff --git a/ai_review/security_middleware.py b/ai_review/security_middleware.py
index ea9e040..1cde8c4 100644
--- a/ai_review/security_middleware.py
+++ b/ai_review/security_middleware.py
@@ -30,7 +30,7 @@ def apply_security_headers(app, csp_policy=None):
                 "default-src 'self'; "
                 "script-src 'self' 'unsafe-inline'; "
                 "style-src 'self' 'unsafe-inline'; "
-                "img-src 'self' data:; "
+                "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
                 "frame-ancestors 'none'"
diff --git a/db/security_middleware.py b/db/security_middleware.py
index a180e14..7e5ee15 100644
--- a/db/security_middleware.py
+++ b/db/security_middleware.py
@@ -30,7 +30,7 @@ def apply_security_headers(app, csp_policy=None):
                 "default-src 'self'; "
                 "script-src 'self' 'unsafe-inline'; "
                 "style-src 'self' 'unsafe-inline'; "
-                "img-src 'self' data:; "
+                "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
                 "frame-ancestors 'none'"
diff --git a/dnfs/security_middleware.py b/dnfs/security_middleware.py
index ea9e040..1cde8c4 100644
--- a/dnfs/security_middleware.py
+++ b/dnfs/security_middleware.py
@@ -30,7 +30,7 @@ def apply_security_headers(app, csp_policy=None):
                 "default-src 'self'; "
                 "script-src 'self' 'unsafe-inline'; "
                 "style-src 'self' 'unsafe-inline'; "
-                "img-src 'self' data:; "
+                "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
                 "frame-ancestors 'none'"
diff --git a/static/security_middleware.py b/static/security_middleware.py
index ea9e040..1cde8c4 100644
--- a/static/security_middleware.py
+++ b/static/security_middleware.py
@@ -30,7 +30,7 @@ def apply_security_headers(app, csp_policy=None):
                 "default-src 'self'; "
                 "script-src 'self' 'unsafe-inline'; "
                 "style-src 'self' 'unsafe-inline'; "
-                "img-src 'self' data:; "
+                "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
                 "frame-ancestors 'none'"
diff --git a/waf/internal/proxy/proxy.go b/waf/internal/proxy/proxy.go
index d5abe66..424b4d7 100644
--- a/waf/internal/proxy/proxy.go
+++ b/waf/internal/proxy/proxy.go
@@ -72,7 +72,7 @@ func setSecurityHeaders(h http.Header) {
 	h.Set("Strict-Transport-Security", "max-age=15552000")
 	h.Set("Content-Security-Policy",
 		"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; "+
-			"img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'")
+			"img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'")
 }
 
 // ServeHTTP 实现 http.Handler。