We will look at the issue as soon as possible

My opinion: can add CSP in administration
For public survey/theme : must be open : allow external video/image etc … for external JS : we need a solution to allow it by theme at minima, then maybe just add it in template ?

CSP can be set anytime by the webserver, there is no need to have this in LimeSurvey itself.

My security office asked for it. Setting the vulnerability as medium.

Then I've set the following configuration in the container:

Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-rer2026'; img-src 'self' 'nonce-rer2026'; style-src 'self' 'nonce-myls2026';"

Now application is giving console errors, mostly because there are parts of frontend having inline <script> with no hash or nonce.

More on what @DenisChenu stated before, there's also the vulnerability risk of writing javascript into the question text. I guess it's kind of "core feature" very precious for altering question widgets, but at the same time pretty dangerous.

For the same motivation, it's recommended to raise the level of security against of XSS.
More context on CSP https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html