high7.0
CVE-2026-44541
ethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override
Impact
Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This issue has been patched in version 2.84.5.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | ethyca-fides | >= 2.33.0, < 2.84.5 | 2.84.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-5qrq-9645-g5g2
- https://github.com/ethyca/fides/security/advisories/GHSA-5qrq-9645-g5g2
- https://github.com/ethyca/fides/commit/67e43b10b1096c7f84d5c0eeba08ee3b7846b7cd
- https://github.com/ethyca/fides/releases/tag/2.84.5
- https://nvd.nist.gov/vuln/detail/CVE-2026-44541