diff --git a/internal/middleware/security.go b/internal/middleware/security.go
index 194a2a7..2c320d7 100644
--- a/internal/middleware/security.go
+++ b/internal/middleware/security.go
@@ -8,10 +8,16 @@ import (
 // 作为纵深防御，不影响业务逻辑，纯附加
 func SecurityHeaders() gin.HandlerFunc {
 	return func(c *gin.Context) {
-		// Content-Security-Policy：仅允许本站资源 + 内联样式/脚本
-		// img-src 允许 data: URI 用于头像裁切预览等场景
+		// Content-Security-Policy
+		// script-src: 本站 + esm.sh CDN (CodeMirror 6 ESM 模块)
+		// connect-src: 本站 (Markdown 预览等 fetch 请求)
+		// img-src: 本站 + data: URI (头像裁切) + blob: (粘贴图片)
 		c.Header("Content-Security-Policy",
-			"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:")
+			"default-src 'self'; "+
+				"script-src 'self' 'unsafe-inline' https://esm.sh; "+
+				"style-src 'self' 'unsafe-inline'; "+
+				"img-src 'self' data: blob:; "+
+				"connect-src 'self'")
 
 		// 禁止 MIME 类型嗅探
 		c.Header("X-Content-Type-Options", "nosniff")
diff --git a/templates/MetaLab-2026/html/posts/new.html b/templates/MetaLab-2026/html/posts/new.html
index ed66b4b..15a47d8 100644
--- a/templates/MetaLab-2026/html/posts/new.html
+++ b/templates/MetaLab-2026/html/posts/new.html
@@ -124,27 +124,6 @@
 
 {{template "layout/footer.html" .}}
 
-{{/* CodeMirror 6 import map (MIT License, from jsdelivr CDN) */}}
-<script type="importmap">
-{
-    "imports": {
-        "@codemirror/state":       "https://cdn.jsdelivr.net/npm/@codemirror/state@6.5.2/dist/index.js",
-        "@codemirror/view":        "https://cdn.jsdelivr.net/npm/@codemirror/view@6.36.4/dist/index.js",
-        "@codemirror/commands":    "https://cdn.jsdelivr.net/npm/@codemirror/commands@6.8.1/dist/index.js",
-        "@codemirror/language":    "https://cdn.jsdelivr.net/npm/@codemirror/language@6.11.0/dist/index.js",
-        "@codemirror/lang-markdown": "https://cdn.jsdelivr.net/npm/@codemirror/lang-markdown@6.3.2/dist/index.js",
-        "@codemirror/language-data": "https://cdn.jsdelivr.net/npm/@codemirror/language-data@6.5.1/dist/index.js",
-        "@codemirror/autocomplete": "https://cdn.jsdelivr.net/npm/@codemirror/autocomplete@6.18.6/dist/index.js",
-        "@codemirror/search":      "https://cdn.jsdelivr.net/npm/@codemirror/search@6.5.10/dist/index.js",
-        "@lezer/common":           "https://cdn.jsdelivr.net/npm/@lezer/common@1.2.3/dist/index.js",
-        "@lezer/highlight":        "https://cdn.jsdelivr.net/npm/@lezer/highlight@1.2.1/dist/index.js",
-        "@lezer/lr":               "https://cdn.jsdelivr.net/npm/@lezer/lr@1.4.2/dist/index.js",
-        "@lezer/markdown":         "https://cdn.jsdelivr.net/npm/@lezer/markdown@1.4.0/dist/index.js",
-        "crelt":                   "https://cdn.jsdelivr.net/npm/crelt@1.0.6/index.js",
-        "style-mod":               "https://cdn.jsdelivr.net/npm/style-mod@4.1.2/src/style-mod.js",
-        "w3c-keyname":             "https://cdn.jsdelivr.net/npm/w3c-keyname@2.2.8/index.js"
-    }
-}
-</script>
+{{/* CodeMirror 6 (MIT License, via esm.sh bundle) */}}
 <script src="/static/js/common.js"></script>
 <script type="module" src="/static/js/editor.js"></script>
diff --git a/templates/MetaLab-2026/static/js/editor.js b/templates/MetaLab-2026/static/js/editor.js
index 1ed32e8..eb22388 100644
--- a/templates/MetaLab-2026/static/js/editor.js
+++ b/templates/MetaLab-2026/static/js/editor.js
@@ -12,15 +12,17 @@
  * - 字数/行数/阅读时间统计
  * - 全屏编辑模式（F11）
  * - 滚动同步（分屏模式下）
+ *
+ * CodeMirror 6 通过 esm.sh bundle 加载，所有依赖自动解析。
  */
-import { EditorState } from '@codemirror/state';
-import { EditorView, keymap, lineNumbers, highlightActiveLine, drawSelection } from '@codemirror/view';
-import { defaultKeymap, history, historyKeymap, indentWithTab } from '@codemirror/commands';
-import { markdown, markdownLanguage } from '@codemirror/lang-markdown';
-import { languages } from '@codemirror/language-data';
-import { syntaxHighlighting, defaultHighlightStyle } from '@codemirror/language';
-import { searchKeymap } from '@codemirror/search';
-import { autocompletion } from '@codemirror/autocomplete';
+import { EditorState } from 'https://esm.sh/@codemirror/state@6.5.2';
+import { EditorView, keymap, lineNumbers, highlightActiveLine, drawSelection } from 'https://esm.sh/@codemirror/view@6.36.4';
+import { defaultKeymap, history, historyKeymap, indentWithTab } from 'https://esm.sh/@codemirror/commands@6.8.1';
+import { markdown, markdownLanguage } from 'https://esm.sh/@codemirror/lang-markdown@6.3.2';
+import { languages } from 'https://esm.sh/@codemirror/language-data@6.5.1';
+import { syntaxHighlighting, defaultHighlightStyle } from 'https://esm.sh/@codemirror/language@6.11.0';
+import { searchKeymap } from 'https://esm.sh/@codemirror/search@6.5.10';
+import { autocompletion } from 'https://esm.sh/@codemirror/autocomplete@6.18.6';
 
 /* ================================================================
    DOM 引用