CVE-2026-44541 Details
Description
Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This issue has been patched in version 2.84.5.
A DOM-based cross-site scripting (XSS) vulnerability has been identified in the Fides privacy engineering platform, specifically in versions 2.33.0 prior to 2.84.5. The issue arises in the fides.js file, where client-controlled description overrides can bypass server-side sanitization when HTML-formatted descriptions are enabled. This vulnerability allows any visitor to execute arbitrary JavaScript in the context of the embedding site's origin, with potential persistence across subdomains via a crafted cookie.
Users are advised to upgrade to Fides version 2.84.5 or later. For Fides Enterprise users, version 2.84.6 contains the same patch. Additionally, the 'FIDES_PRIVACY_CENTER__ALLOW_HTML_DESCRIPTION' environment variable can be set to 'false' to disable HTML descriptions and prevent the XSS vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 8, 2026CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ethyca/fides/security/advisories/GHSA-5qrq-9645-g5g2 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/ethyca/fides/commit/67e43b10b1096c7f84d5c0eeba08ee3b7846b7cd | [email protected] | Source CodeVendor |
| https://github.com/ethyca/fides/releases/tag/2.84.5 | [email protected] | Release NotesVendor |
| https://github.com/ethyca/fides/security/advisories/GHSA-5qrq-9645-g5g2 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ethyca Fides | >= 2.33.0, < 2.84.5 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | New CVE Received | [email protected] |