How it was found

Description

Hi, i would like to report DOM-Based XSS that it's exactly like this one #882546, this one work just because the page /reblog/ID/OTHER_ID doesn't have a correct CSP rule.

Steps to reproduce

1. go to https://www.tumblr.com/reblog/620008931446652928/JBuEvzz5
2. click in click me
3. click in open
4. XSS will be triggered

Impact

it is possible to perform malicious actions on the victim's account