Csweb EUVD-2025-208952

Immediately upgrade Census CSWeb to version 8.1.0 alpha or later once released as stable, as this version contains the fix for stored XSS in user-supplied fields. Until patching is feasible, implement the following compensating controls: enforce strict Content Security Policy (CSP) headers prohibiting inline script execution (script-src 'self'), enable HTTP-only and Secure flags on session cookies to prevent JavaScript access, and deploy a Web Application Firewall (WAF) with rules to detect and block script injection patterns in user input fields. Additionally, restrict network access to CSWeb instances to trusted IP ranges and enforce strong authentication with multi-factor authentication (MFA) to reduce the authenticated attacker surface. Database-level inspection for existing malicious payloads in user-supplied fields should be conducted, and affected records sanitized or flagged for review. Monitor application logs for suspicious activity patterns consistent with XSS exploitation (unusual script tags in form submissions, abnormal session activity). Refer to the Census CSWeb security advisory and the GitHub commit history for detailed patching instructions.