fix: allow data:// and blob:// protocols
diff --git a/src/editor/sandbox/index.js b/src/editor/sandbox/index.js
index 942413f..56ee418 100644
--- a/src/editor/sandbox/index.js
+++ b/src/editor/sandbox/index.js
@@ -40,6 +40,8 @@
       `'self'`,
       `'unsafe-inline'`,
       `'unsafe-eval'`,
+      'data:',
+      'blob:',
       '*.apache.org',
       '*.jsdelivr.net',
       '*.jsdelivr.com',