CVE-2026-44541

Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This issue has been patched in version 2.84.5.

CVSS

No CVSS.

References

Link	Resource
https://github.com/ethyca/fides/commit/67e43b10b1096c7f84d5c0eeba08ee3b7846b7cd
https://github.com/ethyca/fides/releases/tag/2.84.5
https://github.com/ethyca/fides/security/advisories/GHSA-5qrq-9645-g5g2
https://github.com/ethyca/fides/security/advisories/GHSA-5qrq-9645-g5g2

Configurations

No configuration.

History

23 Jul 2026, 08:10

Type	Values Removed	Values Added
Summary		(es) Fides es una plataforma de ingeniería de privacidad de código abierto. Desde la versión 2.33.0 hasta antes de la versión 2.84.5, existe una vulnerabilidad XSS basada en DOM en fides.js a través de la anulación de fides_description. Este problema ha sido parcheado en la versión 2.84.5.

09 Jun 2026, 14:16

Type	Values Removed	Values Added
References	~~() https://github.com/ethyca/fides/security/advisories/GHSA-5qrq-9645-g5g2 -~~	() https://github.com/ethyca/fides/security/advisories/GHSA-5qrq-9645-g5g2 -

08 Jun 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-08 21:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-44541

Mitre link : CVE-2026-44541

CVE.ORG link : CVE-2026-44541

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-44541", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44541", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T12:56:04.591372Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ethyca", "product": "fides", "versions": [{"status": "affected", "version": ">= 2.33.0, < 2.84.5"}]}]}], "published": "2026-06-08T21:16:45.673", "references": [{"url": "https://github.com/ethyca/fides/commit/67e43b10b1096c7f84d5c0eeba08ee3b7846b7cd", "source": "security-advisories@github.com"}, {"url": "https://github.com/ethyca/fides/releases/tag/2.84.5", "source": "security-advisories@github.com"}, {"url": "https://github.com/ethyca/fides/security/advisories/GHSA-5qrq-9645-g5g2", "source": "security-advisories@github.com"}, {"url": "https://github.com/ethyca/fides/security/advisories/GHSA-5qrq-9645-g5g2", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This issue has been patched in version 2.84.5."}, {"lang": "es", "value": "Fides es una plataforma de ingenier\u00eda de privacidad de c\u00f3digo abierto. Desde la versi\u00f3n 2.33.0 hasta antes de la versi\u00f3n 2.84.5, existe una vulnerabilidad XSS basada en DOM en fides.js a trav\u00e9s de la anulaci\u00f3n de fides_description. Este problema ha sido parcheado en la versi\u00f3n 2.84.5."}], "lastModified": "2026-07-23T08:10:00.137", "sourceIdentifier": "security-advisories@github.com"}