We achieved XSS through Cloudflare's /cdn-cgi/image/ endpoint by chaining an SVG sanitizer bypass with a Chromium Cache-Control trick that strips CSP. The same trick also works on Netlify and S3.